@stndrds/schema 0.1.0-alpha.53 → 0.1.0-alpha.55

package/dist/{runtime-B5JYQdZx.d.mts → runtime-ka1bmD0F.d.mts}

@@ -1,6 +1,262 @@
 import { ColorId, IconName, CountryIso3, CurrencyCode, MimeType } from '@stndrds/constants';
+import { JWTPayload } from 'jose';
 import { z } from 'zod';
 
+/**
+ * OCR Adapter Interface for extracting text from documents.
+ *
+ * Implementations:
+ * - GoogleVisionAdapter (schema-nestjs/adapters/ocr/)
+ * - TesseractAdapter (schema-nestjs/adapters/ocr/)
+ *
+ * @example
+ * ```typescript
+ * class GoogleVisionAdapter implements OcrAdapter {
+ *   readonly name = "google-vision";
+ *   readonly supportedMimeTypes = ["image/jpeg", "image/png", "application/pdf"];
+ *
+ *   async extractText(input: OcrInput): Promise<OcrResult> {
+ *     // Call Google Cloud Vision API
+ *   }
+ * }
+ * ```
+ */
+interface OcrAdapter {
+    /** Provider name for identification */
+    readonly name: string;
+    /** MIME types this adapter can process */
+    readonly supportedMimeTypes: readonly string[];
+    /** Extract text from a document */
+    extractText(input: OcrInput): Promise<OcrResult>;
+}
+interface OcrInput {
+    /** File content as Buffer */
+    buffer: Buffer;
+    /** MIME type of the file */
+    mimeType: string;
+    /** Original filename */
+    filename: string;
+    /** OCR options */
+    options?: OcrOptions;
+}
+interface OcrOptions {
+    /** Languages to detect (ISO 639-1 codes) */
+    languages?: string[];
+    /** Enable structured data extraction (forms, tables) */
+    extractStructured?: boolean;
+}
+interface OcrResult {
+    /** Extracted full text */
+    text: string;
+    /** Overall confidence score (0-1) */
+    confidence: number;
+    /** Per-page results */
+    pages?: OcrPage[];
+    /** Structured data if extracted (forms, tables) */
+    structuredData?: Record<string, unknown>;
+}
+interface OcrPage {
+    pageNumber: number;
+    text: string;
+    confidence: number;
+    /** Bounding boxes for detected text blocks */
+    blocks?: OcrTextBlock[];
+}
+interface OcrTextBlock {
+    text: string;
+    confidence: number;
+    boundingBox: BoundingBox;
+}
+interface BoundingBox {
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+}
+/**
+ * Signature Adapter Interface for electronic signatures.
+ *
+ * Implementations:
+ * - YousignAdapter (schema-nestjs/adapters/signature/)
+ * - DocusignAdapter (schema-nestjs/adapters/signature/)
+ *
+ * @example
+ * ```typescript
+ * class YousignAdapter implements SignatureAdapter {
+ *   readonly name = "yousign";
+ *
+ *   async createSignatureRequest(input): Promise<SignatureRequestResult> {
+ *     // Create signature request via Yousign API
+ *   }
+ * }
+ * ```
+ */
+interface SignatureAdapter {
+    /** Provider name for identification */
+    readonly name: string;
+    /** Create a new signature request */
+    createSignatureRequest(input: CreateSignatureInput): Promise<SignatureRequestResult>;
+    /** Get current status of a signature request */
+    getStatus(externalId: string): Promise<SignatureStatusResult>;
+    /** Cancel a pending signature request */
+    cancel(externalId: string): Promise<void>;
+    /** Download the signed document */
+    downloadSignedDocument(externalId: string): Promise<Buffer>;
+}
+interface CreateSignatureInput {
+    /** Document content as Buffer */
+    documentBuffer: Buffer;
+    /** Document filename */
+    documentName: string;
+    /** List of signers */
+    signers: SignerRequest[];
+    /** Expiration date for the signature request */
+    expiresAt?: Date;
+    /** Webhook URL for status updates */
+    webhookUrl?: string;
+    /** Custom metadata to attach */
+    metadata?: Record<string, string>;
+}
+interface SignerRequest {
+    /** Signer's email address */
+    email: string;
+    /** Signer's first name */
+    firstName: string;
+    /** Signer's last name */
+    lastName: string;
+    /** Phone number for SMS verification */
+    phone?: string;
+    /** Signature position on the document */
+    signaturePosition?: SignaturePosition;
+    /** Order in which to sign (1-based) */
+    order?: number;
+}
+interface SignaturePosition {
+    /** Page number (1-based) */
+    page: number;
+    /** X coordinate (from left) */
+    x: number;
+    /** Y coordinate (from top) */
+    y: number;
+    /** Signature box width */
+    width: number;
+    /** Signature box height */
+    height: number;
+}
+interface SignatureRequestResult {
+    /** External ID from the provider */
+    externalId: string;
+    /** URL for signers to access */
+    signatureUrl: string;
+    /** Per-signer URLs if different */
+    signerUrls?: Record<string, string>;
+    /** Current status */
+    status: SignatureStatus;
+}
+interface SignatureStatusResult {
+    /** External ID */
+    externalId: string;
+    /** Current status */
+    status: SignatureStatus;
+    /** Per-signer status */
+    signers?: SignerStatus[];
+    /** Signed document available for download */
+    signedDocumentAvailable?: boolean;
+    /** Completion timestamp */
+    completedAt?: Date;
+    /** Reason for decline (if status is "declined") */
+    declineReason?: string;
+}
+interface SignerStatus {
+    email: string;
+    status: "pending" | "signed" | "declined";
+    signedAt?: Date;
+}
+type SignatureStatus = "pending" | "signed" | "declined" | "expired" | "cancelled";
+/**
+ * Identity Verification Adapter Interface for KYC document verification.
+ *
+ * Implementations:
+ * - OnfidoAdapter (schema-nestjs/adapters/identity/)
+ * - VeriffAdapter (schema-nestjs/adapters/identity/)
+ *
+ * @example
+ * ```typescript
+ * class OnfidoAdapter implements IdentityVerificationAdapter {
+ *   readonly name = "onfido";
+ *   readonly supportedDocumentTypes = ["passport", "national_id", "driving_license"];
+ *
+ *   async verify(input): Promise<VerificationResult> {
+ *     // Verify document via Onfido API
+ *   }
+ * }
+ * ```
+ */
+interface IdentityVerificationAdapter {
+    /** Provider name for identification */
+    readonly name: string;
+    /** Supported document types */
+    readonly supportedDocumentTypes: readonly string[];
+    /** Verify an identity document */
+    verify(input: VerifyInput): Promise<VerificationResult>;
+}
+interface VerifyInput {
+    /** Front side of the document */
+    frontBuffer: Buffer;
+    /** Back side of the document (optional for some document types) */
+    backBuffer?: Buffer;
+    /** Document type (e.g., "passport", "national_id") */
+    documentType: string;
+    /** Country code (ISO 3166-1 alpha-3) */
+    countryCode?: string;
+}
+interface VerificationResult {
+    /** Overall verification passed */
+    verified: boolean;
+    /** Confidence score (0-1) */
+    confidence: number;
+    /** Extracted document data */
+    documentData?: DocumentData;
+    /** Individual verification checks */
+    checks: VerificationCheck[];
+    /** Provider-specific raw response */
+    rawResponse?: Record<string, unknown>;
+}
+interface DocumentData {
+    /** First name */
+    firstName?: string;
+    /** Last name */
+    lastName?: string;
+    /** Full name if not split */
+    fullName?: string;
+    /** Date of birth (ISO 8601) */
+    dateOfBirth?: string;
+    /** Document number */
+    documentNumber?: string;
+    /** Expiry date (ISO 8601) */
+    expiryDate?: string;
+    /** Issue date (ISO 8601) */
+    issueDate?: string;
+    /** Nationality (ISO 3166-1 alpha-3) */
+    nationality?: string;
+    /** Gender */
+    gender?: "M" | "F" | "X";
+    /** Address if present on document */
+    address?: string;
+    /** MRZ data if available */
+    mrz?: string;
+}
+interface VerificationCheck {
+    /** Check name (e.g., "document_authenticity", "face_match") */
+    name: string;
+    /** Check result */
+    status: "passed" | "failed" | "warning" | "not_applicable";
+    /** Human-readable message */
+    message?: string;
+    /** Detailed sub-checks */
+    details?: Record<string, unknown>;
+}
+
 /**
  * Message role in a conversation
  */
@@ -156,6 +412,39 @@ type AIQuestionAnswer = {
     type: "multiselect";
     value: string[];
 };
+/**
+ * Option for batch questions
+ */
+interface AIBatchQuestionOption {
+    /** Value returned when selected */
+    value: string;
+    /** Display label */
+    label: string;
+}
+/**
+ * Question in a batch (for ask_questions tool)
+ */
+interface AIBatchQuestion {
+    /** Unique question ID */
+    id: string;
+    /** Question text to display */
+    question: string;
+    /** Predefined options (if provided, displayed as buttons) */
+    options?: AIBatchQuestionOption[];
+    /** Allow custom text input in addition to options */
+    allowCustomAnswer?: boolean;
+    /** Placeholder for custom input field */
+    placeholder?: string;
+}
+/**
+ * Answer returned by the AgentQuestions widget
+ */
+interface AIBatchQuestionAnswer {
+    /** True if user skipped all questions */
+    skipped: boolean;
+    /** Map of question ID to answer value */
+    answers: Record<string, string>;
+}
 /**
  * Todo item status
  */
@@ -381,8 +670,46 @@ declare function generateId(): Uuid;
  * ```
  */
 declare function generatePrefixedId(prefix: string): Uuid;
+/**
+ * Convert a string to a valid kebab-case slug.
+ * Removes accents, special chars, and normalizes spaces.
+ *
+ * @param input - The string to slugify
+ * @returns A kebab-case slug matching pattern ^[a-z][a-z0-9-]*$
+ *
+ * @example
+ * ```typescript
+ * slugify("Contrat de Vente");
+ * // "contrat-de-vente"
+ *
+ * slugify("Éléphant café");
+ * // "elephant-cafe"
+ *
+ * slugify("  Multiple   Spaces  ");
+ * // "multiple-spaces"
+ * ```
+ */
+declare function slugify(input: string): string;
+/**
+ * Generate a unique template name from a label.
+ * Format: {slugified-label}-{8-char-suffix}
+ * Matches DB constraint: ^[a-z][a-z0-9_-]*$
+ *
+ * @param label - The label to generate a name from
+ * @returns A unique kebab-case name
+ *
+ * @example
+ * ```typescript
+ * generateTemplateName("Contrat de Vente");
+ * // "contrat-de-vente-a1b2c3d4"
+ *
+ * generateTemplateName("");
+ * // "template-a1b2c3d4"
+ * ```
+ */
+declare function generateTemplateName(label: string): string;
 
-type AttributeType = "text" | "textarea" | "richtext" | "number" | "checkbox" | "date" | "phone" | "currency" | "status" | "location" | "select" | "multiselect" | "file" | "user" | "relation" | "rating" | "formula" | "rollup";
+type AttributeType = "text" | "textarea" | "richtext" | "number" | "checkbox" | "date" | "phone" | "currency" | "status" | "location" | "select" | "multiselect" | "file" | "user" | "relation" | "rating" | "formula" | "rollup" | "document";
 /**
  * Status group categorization
  */
@@ -748,7 +1075,57 @@ interface RollupAttribute extends Omit<BaseAttribute<never>, "defaultValue" | "r
      */
     targetAttributeOptions?: Option[];
 }
-type Attribute = TextAttribute | TextAreaAttribute | RichtextAttribute | NumberAttribute | CheckboxAttribute | DateAttribute | PhoneAttribute | CurrencyAttribute | StatusAttribute | LocationAttribute | SelectAttribute | MultiselectAttribute | FileAttribute | UserAttribute | RelationAttribute | RatingAttribute | FormulaAttribute | RollupAttribute;
+/**
+ * DocumentAttribute - References one or multiple documents with templates.
+ *
+ * Unlike FileAttribute which stores raw file references, DocumentAttribute
+ * provides structured document handling with templates, multi-file support,
+ * and automatic processing (OCR, signature, identity verification).
+ *
+ * @example Single document with template choice
+ * ```typescript
+ * document({ name: "identityDocument", label: "Pièce d'identité" })
+ *   .templates(["french_id_card", "passport"])
+ *   .autoProcess()
+ *   .required()
+ * ```
+ *
+ * @example Multiple documents with fixed template
+ * ```typescript
+ * document({ name: "contracts", label: "Contrats" })
+ *   .template("signable_contract")
+ *   .multiple()
+ *   .maxDocuments(10)
+ * ```
+ */
+interface DocumentAttribute extends BaseAttribute<string | string[]> {
+    type: "document";
+    /**
+     * Single template ID (strict mode).
+     * If set, only documents using this template can be attached.
+     */
+    templateId?: string;
+    /**
+     * Multiple allowed template IDs.
+     * User can choose which template to use when uploading.
+     */
+    allowedTemplates?: string[];
+    /**
+     * Allow multiple documents.
+     * If true, value is string[] (document IDs).
+     * If false/undefined, value is string (single document ID).
+     */
+    multiple?: boolean;
+    /**
+     * Maximum number of documents when multiple: true.
+     */
+    maxDocuments?: number;
+    /**
+     * Automatically trigger processing (OCR, verification) on upload.
+     */
+    autoProcess?: boolean;
+}
+type Attribute = TextAttribute | TextAreaAttribute | RichtextAttribute | NumberAttribute | CheckboxAttribute | DateAttribute | PhoneAttribute | CurrencyAttribute | StatusAttribute | LocationAttribute | SelectAttribute | MultiselectAttribute | FileAttribute | UserAttribute | RelationAttribute | RatingAttribute | FormulaAttribute | RollupAttribute | DocumentAttribute;
 
 /**
  * Type of resource that can be audited
@@ -853,6 +1230,175 @@ interface AuditServiceOptions {
     flushIntervalMs?: number;
 }
 
+/**
+ * Variable mapping from template placeholder to context path
+ */
+interface VariableMapping {
+    /** Placeholder name in the template */
+    variableName: string;
+    /** Path in WorkflowExecutionContext (e.g., "slots.client.firstName") */
+    contextPath: string;
+    /** Display label for the UI */
+    label: string;
+    /** Whether this variable is required */
+    required?: boolean;
+    /** Fallback value if the context path resolves to null/undefined */
+    fallback?: string;
+}
+/**
+ * Field positioned on a PDF template
+ * Coordinates are in PDF points (72 dpi)
+ */
+interface PdfTemplateField {
+    /** Unique field identifier */
+    id: string;
+    /** Page number (0-indexed) */
+    page: number;
+    /** X coordinate in PDF points */
+    x: number;
+    /** Y coordinate in PDF points */
+    y: number;
+    /** Field width in PDF points */
+    width: number;
+    /** Field height in PDF points */
+    height: number;
+    /** Font size in points */
+    fontSize?: number;
+    /** Font family name */
+    fontFamily?: string;
+    /** Font weight */
+    fontWeight?: "normal" | "bold";
+    /** Text alignment */
+    align?: "left" | "center" | "right";
+    /** Path in WorkflowExecutionContext (e.g., "slots.client.firstName") */
+    contextPath: string;
+    /** Display label for the UI */
+    label: string;
+    /** Fallback value if the context path resolves to null/undefined */
+    fallback?: string;
+}
+/**
+ * Template source - discriminated union for PDF vs DOCX modes
+ */
+type TemplateSource = {
+    type: "pdf";
+    /** ID of the uploaded PDF file */
+    fileId: string;
+    /** Positioned fields on the PDF */
+    fields: PdfTemplateField[];
+} | {
+    type: "docx";
+    /** ID of the uploaded DOCX file */
+    fileId: string;
+    /** Variables detected in the DOCX (e.g., {{firstName}}) */
+    detectedVariables: string[];
+};
+/**
+ * Document generation template
+ *
+ * Templates define how to generate PDF documents by injecting
+ * workflow context data into a PDF template file.
+ *
+ * @example
+ * ```typescript
+ * const template: DocumentGenerationTemplate = {
+ *   id: "tmpl_123",
+ *   name: "sales-contract",
+ *   label: "Sales Contract",
+ *   source: {
+ *     type: "pdf",
+ *     fileId: "file_456",
+ *     fields: [
+ *       {
+ *         id: "f1",
+ *         page: 0,
+ *         x: 120, y: 340,
+ *         width: 150, height: 20,
+ *         contextPath: "slots.client.firstName",
+ *         label: "Client First Name"
+ *       }
+ *     ]
+ *   },
+ *   variableMappings: [],
+ *   createdAt: new Date(),
+ *   updatedAt: new Date()
+ * };
+ * ```
+ */
+interface DocumentGenerationTemplate {
+    /** Unique identifier */
+    id: string;
+    /** Tenant ID (optional for system templates) */
+    tenantId?: string;
+    /** Unique name within tenant (kebab-case) */
+    name: string;
+    /** Display label */
+    label: string;
+    /** Optional description */
+    description?: string;
+    /** Template source (PDF) */
+    source: TemplateSource;
+    /** Variable mappings (for DOCX mode, deprecated) */
+    variableMappings: VariableMapping[];
+    /** Creation timestamp */
+    createdAt: Date;
+    /** Last update timestamp */
+    updatedAt: Date;
+}
+/**
+ * Input for creating a document generation template
+ */
+interface CreateDocumentGenerationTemplate {
+    name: string;
+    label: string;
+    description?: string;
+    source: TemplateSource;
+    variableMappings?: VariableMapping[];
+}
+/**
+ * Input for updating a document generation template
+ */
+interface UpdateDocumentGenerationTemplate {
+    label?: string;
+    description?: string;
+    source?: TemplateSource;
+    variableMappings?: VariableMapping[];
+}
+/**
+ * Pending document generation request in execution context.
+ * The consumer (NestJS, Supabase) is responsible for fulfilling this request.
+ */
+interface PendingDocumentRequest {
+    /** Unique request identifier (same as node ID) */
+    id: string;
+    /** Template ID to use for generation */
+    templateId: string;
+    /** Custom filename (supports variable interpolation) */
+    filename?: string;
+    /** Slot IDs of records to attach the generated document to */
+    targetSlotIds?: string[];
+    /** Request status */
+    status: "pending" | "processing" | "completed" | "failed";
+    /** Error message if failed */
+    error?: string;
+    /** Generated document URL (when completed) */
+    url?: string;
+    /** File size in bytes (when completed) */
+    size?: number;
+}
+/**
+ * Check if a template source is PDF type
+ */
+declare function isPdfTemplateSource(source: TemplateSource): source is Extract<TemplateSource, {
+    type: "pdf";
+}>;
+/**
+ * Check if a template source is DOCX type
+ */
+declare function isDocxTemplateSource(source: TemplateSource): source is Extract<TemplateSource, {
+    type: "docx";
+}>;
+
 /**
  * Timestamps for tracking creation and updates
  */
@@ -1022,52 +1568,339 @@ declare const RESERVED_ATTRIBUTE_NAMES: readonly ["id", "createdAt", "updatedAt"
 type ReservedAttributeName = (typeof RESERVED_ATTRIBUTE_NAMES)[number];
 
 /**
- * Storage provider type
+ * DocumentTemplate defines the structure and processing rules for a document type.
+ *
+ * Templates can be:
+ * - System templates: Defined in code, available to all tenants (tenantId: null)
+ * - Custom templates: Created by tenants for their specific needs
+ *
+ * @example
+ * ```typescript
+ * const FRENCH_ID_CARD: DocumentTemplate = {
+ *   name: "french_id_card",
+ *   label: "Carte d'identité française",
+ *   system: true,
+ *   slots: [
+ *     { name: "front", label: "Recto", required: true, order: 1 },
+ *     { name: "back", label: "Verso", required: true, order: 2 },
+ *   ],
+ *   autoProcessing: {
+ *     ocr: { enabled: true },
+ *     identityVerification: { enabled: true, documentType: "national_id" },
+ *   },
+ * };
+ * ```
  */
-type StorageProvider = "s3" | "gcs" | "azure" | "local" | "cloudflare-r2" | string;
+interface DocumentTemplate extends Timestamps {
+    id: Uuid;
+    /** null = system template available to all tenants */
+    tenantId?: Uuid | null;
+    /** Technical name (kebab-case, unique per tenant) */
+    name: string;
+    /** Display name */
+    label: string;
+    description?: string;
+    icon?: IconName;
+    /** Slot definitions for multi-file documents */
+    slots: DocumentSlotDefinition[];
+    /** Allow uploading additional files beyond defined slots */
+    allowAdditionalFiles: boolean;
+    /** Auto-processing configuration */
+    autoProcessing?: DocumentAutoProcessing;
+    /** Mapping for extracting data to record attributes */
+    extractionMapping?: ExtractionMapping;
+    /** System templates are defined in code and cannot be modified */
+    system: boolean;
+}
 /**
- * File visibility level
+ * Defines a file slot within a document template.
+ *
+ * @example ID card with front/back
+ * ```typescript
+ * slots: [
+ *   { name: "front", label: "Recto", required: true, order: 1 },
+ *   { name: "back", label: "Verso", required: true, order: 2 },
+ * ]
+ * ```
  */
-type FileVisibility = "public" | "private" | "restricted";
+interface DocumentSlotDefinition {
+    /** Technical name (e.g., "front", "back", "main") */
+    name: string;
+    /** Display label */
+    label: string;
+    description?: string;
+    /** Whether this slot must be filled */
+    required: boolean;
+    /** Allowed MIME types (e.g., ["image/jpeg", "application/pdf"]) */
+    allowedMimeTypes?: MimeType[];
+    /** Max file size in bytes */
+    maxSize?: number;
+    /** Display order */
+    order: number;
+}
 /**
- * File - Represents uploaded file metadata and storage info
+ * Auto-processing configuration for document templates.
+ * Defines which processing jobs to run automatically on upload.
+ */
+interface DocumentAutoProcessing {
+    ocr?: {
+        enabled: boolean;
+        provider?: string;
+        languages?: string[];
+    };
+    identityVerification?: {
+        enabled: boolean;
+        provider?: string;
+        documentType?: string;
+    };
+    signature?: {
+        enabled: boolean;
+        provider?: string;
+    };
+}
+/**
+ * Mapping configuration for extracting OCR data to record attributes.
+ */
+interface ExtractionMapping {
+    fields: ExtractionField[];
+}
+interface ExtractionField {
+    /** Source field path in OCR result */
+    source: string;
+    /** Target attribute name on the record */
+    target: string;
+    /** Optional transformation function name */
+    transform?: string;
+}
+/**
+ * Document wraps one or more files with metadata, status, and processing results.
  *
- * ARCHITECTURE:
- * - Fixed table (no custom attributes)
- * - Manages file storage, permissions, and metadata
- * - uploadedBy links to user_profiles table
- * - Supports soft delete via deletedAt
+ * Documents are linked to records via the record's `values` (document attribute).
+ * Each document references a template that defines its structure.
  *
  * @example
  * ```typescript
- * const file: File = {
- *   id: "file-123",
+ * const document: Document = {
+ *   id: "doc-123",
  *   tenantId: "tenant-456",
- *   name: "contract-2025.pdf",
- *   originalName: "Contract Acme Corp 2025.pdf",
- *   mimeType: "application/pdf",
- *   size: 2458624,
- *   storageProvider: "s3",
- *   storagePath: "tenants/456/files/2025/11/contract-2025.pdf",
- *   storageBucket: "my-app-files",
- *   url: "https://cdn.example.com/files/file-123",
- *   uploadedBy: "profile-789",
- *   folderPath: "/contracts/2025",
- *   tags: ["contract", "legal"],
- *   visibility: "restricted",
- *   allowedUsers: ["profile-789", "profile-456"],
- *   createdAt: new Date(),
- *   updatedAt: new Date(),
+ *   templateId: "tpl-french-id",
+ *   status: "completed",
+ *   title: "CNI - Jean Dupont",
+ *   tags: ["identity", "verified"],
  * };
  * ```
  */
-interface File extends Timestamps {
+interface Document extends Timestamps {
     id: Uuid;
     tenantId: Uuid;
-    /**
-     * File name (sanitized for storage)
-     */
-    name: string;
+    templateId: Uuid;
+    /** Current processing/lifecycle status */
+    status: DocumentStatus;
+    /** Display title */
+    title: string;
+    description?: string;
+    /** Tags for categorization and search */
+    tags: string[];
+    /** Hash of all slot file contents for deduplication */
+    contentHash?: string;
+    /** PostgreSQL tsvector for full-text search */
+    searchVector?: unknown;
+    /** User who created this document */
+    createdBy?: Uuid;
+    /** User who last updated this document */
+    updatedBy?: Uuid;
+    /** Soft delete timestamp */
+    deletedAt?: Date | null;
+}
+/**
+ * Document lifecycle status.
+ *
+ * - `draft`: Missing required slots, incomplete
+ * - `pending`: All slots uploaded, awaiting processing
+ * - `processing`: One or more jobs running
+ * - `completed`: All jobs completed successfully
+ * - `failed`: At least one job failed
+ * - `signed`: Signature workflow completed
+ */
+type DocumentStatus = "draft" | "pending" | "processing" | "completed" | "failed" | "signed";
+/**
+ * DocumentSlot represents a single file within a document.
+ *
+ * Each slot corresponds to a slot definition in the template,
+ * or is marked as "additional" for extra files.
+ */
+interface DocumentSlot extends Timestamps {
+    id: Uuid;
+    documentId: Uuid;
+    /** Slot name from template definition */
+    slotName: string;
+    /** True if this is an additional file beyond template slots */
+    isAdditional: boolean;
+    /** Reference to the uploaded file */
+    fileId: Uuid;
+    /** Processing status for this slot */
+    status: SlotStatus;
+    /** Extracted text from OCR */
+    ocrText?: string;
+    /** OCR confidence score (0-1) */
+    ocrConfidence?: number;
+}
+/**
+ * Slot processing status.
+ */
+type SlotStatus = "uploaded" | "processing" | "completed" | "failed";
+/**
+ * ProcessingJob tracks an async processing task for a document.
+ *
+ * Jobs are created for OCR, identity verification, or signature requests.
+ * They can be document-level or slot-level.
+ */
+interface ProcessingJob extends Timestamps {
+    id: Uuid;
+    tenantId: Uuid;
+    documentId: Uuid;
+    /** Slot name if job is slot-specific, null for document-level jobs */
+    slotName?: string | null;
+    /** Job type */
+    type: ProcessingJobType;
+    /** Provider used (e.g., "google-vision", "yousign") */
+    provider: string;
+    /** Current job status */
+    status: ProcessingJobStatus;
+    /** Provider-specific input data */
+    input?: Record<string, unknown>;
+    /** Provider response data */
+    result?: Record<string, unknown>;
+    /** Error message if failed */
+    error?: string;
+    /** When processing started */
+    startedAt?: Date | null;
+    /** When processing completed */
+    completedAt?: Date | null;
+    /** Expiration time (for signature requests) */
+    expiresAt?: Date | null;
+    /** User who initiated the job */
+    createdBy?: Uuid;
+}
+type ProcessingJobType = "ocr" | "identity_verification" | "signature";
+type ProcessingJobStatus = "pending" | "processing" | "completed" | "failed" | "cancelled";
+interface CreateDocument {
+    templateId: Uuid;
+    title: string;
+    description?: string;
+    tags?: string[];
+}
+interface UpdateDocument {
+    title?: string;
+    description?: string;
+    tags?: string[];
+    status?: DocumentStatus;
+}
+interface CreateDocumentTemplate {
+    name: string;
+    label: string;
+    description?: string;
+    icon?: IconName;
+    slots: DocumentSlotDefinition[];
+    allowAdditionalFiles?: boolean;
+    autoProcessing?: DocumentAutoProcessing;
+    extractionMapping?: ExtractionMapping;
+}
+interface UpdateDocumentTemplate {
+    label?: string;
+    description?: string;
+    icon?: IconName;
+    slots?: DocumentSlotDefinition[];
+    allowAdditionalFiles?: boolean;
+    autoProcessing?: DocumentAutoProcessing;
+    extractionMapping?: ExtractionMapping;
+}
+interface CreateDocumentSlot {
+    documentId: Uuid;
+    slotName: string;
+    fileId: Uuid;
+    isAdditional?: boolean;
+}
+interface UpdateDocumentSlot {
+    status?: SlotStatus;
+    ocrText?: string;
+    ocrConfidence?: number;
+}
+interface CreateProcessingJob {
+    documentId: Uuid;
+    slotName?: string;
+    type: ProcessingJobType;
+    provider: string;
+    input?: Record<string, unknown>;
+    expiresAt?: Date;
+}
+interface UpdateProcessingJob {
+    status?: ProcessingJobStatus;
+    result?: Record<string, unknown>;
+    error?: string;
+    startedAt?: Date;
+    completedAt?: Date;
+}
+interface DocumentListOptions {
+    limit?: number;
+    offset?: number;
+    templateId?: Uuid;
+    status?: DocumentStatus;
+    tags?: string[];
+}
+interface DocumentTemplateListOptions {
+    systemOnly?: boolean;
+    limit?: number;
+    offset?: number;
+}
+
+/**
+ * Storage provider type
+ */
+type StorageProvider = "s3" | "gcs" | "azure" | "local" | "cloudflare-r2" | string;
+/**
+ * File visibility level
+ */
+type FileVisibility = "public" | "private" | "restricted";
+/**
+ * File - Represents uploaded file metadata and storage info
+ *
+ * ARCHITECTURE:
+ * - Fixed table (no custom attributes)
+ * - Manages file storage, permissions, and metadata
+ * - uploadedBy links to user_profiles table
+ * - Supports soft delete via deletedAt
+ *
+ * @example
+ * ```typescript
+ * const file: File = {
+ *   id: "file-123",
+ *   tenantId: "tenant-456",
+ *   name: "contract-2025.pdf",
+ *   originalName: "Contract Acme Corp 2025.pdf",
+ *   mimeType: "application/pdf",
+ *   size: 2458624,
+ *   storageProvider: "s3",
+ *   storagePath: "tenants/456/files/2025/11/contract-2025.pdf",
+ *   storageBucket: "my-app-files",
+ *   url: "https://cdn.example.com/files/file-123",
+ *   uploadedBy: "profile-789",
+ *   folderPath: "/contracts/2025",
+ *   tags: ["contract", "legal"],
+ *   visibility: "restricted",
+ *   allowedUsers: ["profile-789", "profile-456"],
+ *   createdAt: new Date(),
+ *   updatedAt: new Date(),
+ * };
+ * ```
+ */
+interface File extends Timestamps {
+    id: Uuid;
+    tenantId: Uuid;
+    /**
+     * File name (sanitized for storage)
+     */
+    name: string;
     /**
      * Original file name (as uploaded by user)
      */
@@ -1576,6 +2409,8 @@ type AttributeValueMap = {
     user: string;
     relation: string;
     rating: number;
+    /** Document ID(s) - string if single, string[] if multiple */
+    document: string | string[];
 };
 /**
  * Infer status value from options (union of option values)
@@ -2094,7 +2929,7 @@ interface AssignRoleInput {
  * Document generated during workflow execution
  */
 interface GeneratedDocument {
-    /** Document ID */
+    /** Document ID (file ID) */
     id: string;
     /** URL to access the document */
     url: string;
@@ -2106,6 +2941,8 @@ interface GeneratedDocument {
     size?: number;
     /** Additional metadata */
     metadata?: Record<string, unknown>;
+    /** IDs of Document records created (one per target slot) */
+    attachedDocumentIds?: string[];
 }
 /**
  * Accumulated context during workflow execution.
@@ -2453,6 +3290,44 @@ interface ConditionNode extends BaseNode {
     /** ID of node to execute if condition is false (optional for drafts) */
     onFalse?: string | null;
 }
+/**
+ * Document generation node.
+ * Generates a PDF document by injecting workflow data into a template.
+ *
+ * The actual generation is delegated to the consumer (NestJS, Supabase).
+ * The executor creates a pending document request in the context.
+ *
+ * @example
+ * ```typescript
+ * const node: DocumentNode = {
+ *   type: "document",
+ *   id: "generate-contract",
+ *   label: "Generate Contract",
+ *   templateId: "tmpl_sales-contract",
+ *   outputFormat: "pdf",
+ *   filename: "contract_{{slots.client.lastName}}.pdf",
+ *   targetSlotIds: ["client", "vendor"],
+ *   next: "send-email"
+ * };
+ * ```
+ */
+interface DocumentNode extends BaseNode {
+    type: "document";
+    /** Display label for the node */
+    label: string;
+    /** Optional description */
+    description?: string;
+    /** ID of the DocumentGenerationTemplate to use */
+    templateId: string;
+    /** Output format for generated document */
+    outputFormat: "pdf" | "docx";
+    /** Custom filename (supports variable interpolation like {{slots.client.lastName}}) */
+    filename?: string;
+    /** ID of the next node to execute */
+    next?: string | null;
+    /** Slot IDs of records to attach the generated document to */
+    targetSlotIds?: string[];
+}
 /**
  * Terminal node marking the end of a workflow path.
  * A workflow can have multiple EndNodes for different outcomes.
@@ -2488,7 +3363,7 @@ interface EndNode extends BaseNode {
  * Union of all workflow node types.
  * Use discriminated union on `type` field for type narrowing.
  */
-type WorkflowNode = StartNode | FormNode | ConditionNode | EndNode;
+type WorkflowNode = StartNode | FormNode | ConditionNode | DocumentNode | EndNode;
 /**
  * All possible node types
  */
@@ -2505,6 +3380,10 @@ declare function isFormNode(node: WorkflowNode): node is FormNode;
  * Check if a node is a ConditionNode
  */
 declare function isConditionNode(node: WorkflowNode): node is ConditionNode;
+/**
+ * Check if a node is a DocumentNode
+ */
+declare function isDocumentNode(node: WorkflowNode): node is DocumentNode;
 /**
  * Check if a node is an EndNode
  */
@@ -2667,70 +3546,6 @@ interface WorkflowLayout {
     /** Canvas viewport state */
     viewport?: CanvasViewport;
 }
-/**
- * Authentication method for external participants
- */
-type AuthMethod = "signed_link" | "pin_code";
-/**
- * Channel for sending authentication credentials
- */
-type AuthChannel = "email" | "sms";
-/**
- * Default authentication configuration for a participant
- */
-interface ParticipantAuthConfig {
-    /** Authentication method */
-    method: AuthMethod;
-    /** Link/code expiration (e.g., "7d", "24h") */
-    expiresIn?: string;
-    /** Channel for sending credentials */
-    channel?: AuthChannel;
-}
-/**
- * Template for a participant in the workflow.
- * Defines who can participate and how they authenticate.
- *
- * Note: This is a template defined in WorkflowDefinition.
- * At runtime, WorkflowParticipation instances are created from this.
- *
- * @example
- * ```typescript
- * const externalClient: ParticipantTemplate = {
- *   id: "external-client",
- *   label: "Client Externe",
- *   type: "external",
- *   emailSource: "slots.client.email",
- *   defaultAuth: {
- *     method: "signed_link",
- *     expiresIn: "7d",
- *     channel: "email"
- *   },
- *   allowedNodeIds: ["client-form", "signature-step"]
- * };
- * ```
- */
-interface ParticipantTemplate {
-    /** Unique identifier */
-    id: string;
-    /** Display label */
-    label: string;
-    /** Type of participant */
-    type: "internal" | "external";
-    /**
-     * Path to email in execution context (for external participants).
-     * Supports dot notation: "slots.client.email"
-     */
-    emailSource?: string;
-    /**
-     * Path to phone in execution context (for SMS auth).
-     * Supports dot notation: "slots.client.phone"
-     */
-    phoneSource?: string;
-    /** Default authentication configuration */
-    defaultAuth: ParticipantAuthConfig;
-    /** IDs of nodes this participant can execute */
-    allowedNodeIds: string[];
-}
 /**
  * Global configuration options for a workflow
  */
@@ -2765,8 +3580,7 @@ type WorkflowStatus = "draft" | "published" | "archived";
  *     "form-1": { type: "form", id: "form-1", label: "Info", slotId: "client", fields: ["name"], next: "end" },
  *     "end": { type: "end", id: "end" }
  *   },
- *   startNodeId: "start",
- *   layout: { positions: { "start": { x: 0, y: 0 }, "form-1": { x: 200, y: 0 }, "end": { x: 400, y: 0 } } }
+ *   startNodeId: "start"
  * };
  * ```
  */
@@ -2791,10 +3605,8 @@ interface WorkflowDefinition {
     nodes: Record<string, WorkflowNode>;
     /** ID of the start node */
     startNodeId: string;
-    /** Layout information for the visual builder */
-    layout: WorkflowLayout;
-    /** Participant templates (for external users) */
-    participants?: ParticipantTemplate[];
+    /** Layout information for the visual builder (optional, used by legacy canvas) */
+    layout?: WorkflowLayout;
     /** Theming for external-facing interface */
     theme?: WorkflowTheme;
     /** Global configuration options */
@@ -3005,7 +3817,7 @@ interface Group {
     collapsed?: boolean;
     order?: number;
 }
-type TabType = "form" | "table" | "custom" | "activity" | "notes" | "flows";
+type TabType = "form" | "table" | "custom" | "activity" | "notes" | "flows" | "documents";
 /**
  * Base properties shared by all tab types
  */
@@ -3160,10 +3972,45 @@ interface FlowsTab extends BaseTab {
     /** Columns to display in the instances table */
     columns?: ("workflow" | "status" | "startedBy" | "createdAt" | "updatedAt")[];
 }
+/**
+ * Documents tab - displays all documents attached to the record
+ *
+ * Shows documents from:
+ * - Document attributes defined on the object
+ * - System `attachments` attribute (free-form documents)
+ *
+ * Allows uploading new documents either to a specific attribute or as attachments.
+ *
+ * @example
+ * ```typescript
+ * {
+ *   type: "documents",
+ *   id: "documents",
+ *   name: "documents",
+ *   label: "Documents",
+ *   allowUpload: true,
+ *   allowRemove: true,
+ *   showProcessing: true
+ * }
+ * ```
+ */
+interface DocumentsTab extends BaseTab {
+    type: "documents";
+    /** Allow uploading new documents (default: true) */
+    allowUpload?: boolean;
+    /** Allow removing documents (default: true) */
+    allowRemove?: boolean;
+    /** Show processing actions (OCR, verify, sign) (default: true) */
+    showProcessing?: boolean;
+    /** Highlight empty required document attributes (default: true) */
+    showRequiredWarnings?: boolean;
+    /** Hide system attachments section (default: false) */
+    hideAttachments?: boolean;
+}
 /**
  * Union of all tab types
  */
-type Tab = FormTab | TableTab | CustomTab | ActivityTab | NotesTab | FlowsTab;
+type Tab = FormTab | TableTab | CustomTab | ActivityTab | NotesTab | FlowsTab | DocumentsTab;
 /**
  * View layout mode
  * - `page`: Full view with multiple tabs (form, table, activity, notes, custom)
@@ -3249,125 +4096,173 @@ declare function isNotesTab(tab: Tab): tab is NotesTab;
  * Check if a tab is a flows tab
  */
 declare function isFlowsTab(tab: Tab): tab is FlowsTab;
+/**
+ * Check if a tab is a documents tab
+ */
+declare function isDocumentsTab(tab: Tab): tab is DocumentsTab;
 
 /**
- * Status of a workflow participation
+ * Status of a workflow invitation
  */
-type ParticipationStatus = "pending" | "active" | "completed" | "expired" | "revoked";
+type InvitationStatus = "pending" | "accepted" | "expired" | "revoked";
 /**
- * Signed link authentication (JWT-based)
+ * Represents an invitation to access a workflow instance.
+ *
+ * When an admin wants to share a workflow with an external user,
+ * they create an invitation. The invitation generates a magic link
+ * that the user clicks to get an access grant.
+ *
+ * @example
+ * ```typescript
+ * const invitation: WorkflowInvitation = {
+ *   id: "inv_123",
+ *   instanceId: "inst_456",
+ *   recipientEmail: "client@example.com",
+ *   recipientName: "John Doe",
+ *   status: "pending",
+ *   createdBy: "user_789",
+ *   createdAt: new Date(),
+ *   expiresAt: new Date("2024-02-15")
+ * };
+ * ```
  */
-interface SignedLinkAuth {
-    type: "signed_link";
-    /** JWT token for authentication */
-    token: string;
-    /** Token expiration date */
+interface WorkflowInvitation {
+    /** Unique invitation ID */
+    id: Uuid;
+    /** ID of the workflow instance */
+    instanceId: Uuid;
+    /** Recipient's email */
+    recipientEmail: string;
+    /** Recipient's display name */
+    recipientName?: string;
+    /** Current invitation status */
+    status: InvitationStatus;
+    /** ID of the user who created the invitation */
+    createdBy: string;
+    /** When the invitation was created */
+    createdAt: Date;
+    /** When the invitation was accepted */
+    acceptedAt?: Date;
+    /** When the invitation expires */
     expiresAt: Date;
-    /** Whether the link has been used */
-    used: boolean;
-    /** IP address that used the link (for audit) */
-    usedFromIp?: string;
 }
 /**
- * PIN code authentication
+ * Input for creating a workflow invitation
  */
-interface PinCodeAuth {
-    type: "pin_code";
-    /** Hashed PIN code */
-    codeHash: string;
-    /** Code expiration date */
-    expiresAt: Date;
-    /** Number of failed attempts */
-    attempts: number;
-    /** Max allowed attempts before lockout */
-    maxAttempts: number;
-    /** Whether currently locked out */
-    lockedOut: boolean;
-    /** When lockout expires */
-    lockedUntil?: Date;
+interface CreateInvitationInput {
+    /** Workflow instance ID */
+    instanceId: string;
+    /** Recipient email */
+    recipientEmail: string;
+    /** Recipient name (optional) */
+    recipientName?: string;
+    /** Expiration in days (default: 7) */
+    expiresInDays?: number;
+    /** Whether to send notification email */
+    sendEmail?: boolean;
+}
+/**
+ * Result of creating a workflow invitation
+ */
+interface CreateInvitationResult {
+    /** The created invitation */
+    invitation: WorkflowInvitation;
+    /** Full magic link URL to access the workflow */
+    magicLink: string;
 }
 /**
- * Union of all authentication types
+ * Check if invitation is still valid (not expired, not revoked)
+ */
+declare function isInvitationValid(invitation: WorkflowInvitation): boolean;
+/**
+ * Check if invitation has been accepted
  */
-type ParticipationAuth = SignedLinkAuth | PinCodeAuth;
+declare function isInvitationAccepted(invitation: WorkflowInvitation): boolean;
 /**
- * Represents an external or internal user's participation in a workflow instance.
+ * Check if invitation has expired
+ */
+declare function isInvitationExpired(invitation: WorkflowInvitation): boolean;
+
+/**
+ * Represents an access grant to a workflow instance.
+ *
+ * A grant is created after a user successfully authenticates via magic link.
+ * It allows them to access the workflow forms with JWT access tokens.
  *
- * Created at runtime from ParticipantTemplate when the workflow reaches
- * a node that requires participation.
+ * The grant can be revoked entirely (revokedAt) or individual tokens
+ * can be revoked via the revokedTokenJtis array.
  *
  * @example
  * ```typescript
- * const participation: WorkflowParticipation = {
- *   id: "part_123",
- *   instanceId: "inst_456",
- *   participantTemplateId: "external-client",
- *   type: "external",
- *   email: "client@example.com",
- *   name: "John Doe",
- *   auth: {
- *     type: "signed_link",
- *     token: "eyJ...",
- *     expiresAt: new Date("2024-01-15"),
- *     used: false
- *   },
- *   allowedNodeIds: ["client-form", "signature-step"],
- *   status: "pending",
+ * const grant: WorkflowAccessGrant = {
+ *   id: "grant_123",
+ *   invitationId: "inv_456",
+ *   instanceId: "inst_789",
+ *   grantedTo: "client@example.com",
+ *   scope: ["*"],
+ *   revokedTokenJtis: [],
+ *   validUntil: new Date("2024-03-15"),
  *   createdAt: new Date()
  * };
  * ```
  */
-interface WorkflowParticipation {
-    /** Unique participation ID */
+interface WorkflowAccessGrant {
+    /** Unique grant ID */
     id: Uuid;
+    /** ID of the invitation that created this grant */
+    invitationId: Uuid;
     /** ID of the workflow instance */
     instanceId: Uuid;
-    /** ID of the participant template this was created from */
-    participantTemplateId: string;
-    /** Type of participant */
-    type: "internal" | "external";
-    /** Participant's email */
-    email: string;
-    /** Participant's display name */
-    name?: string;
-    /** Participant's phone (for SMS auth) */
-    phone?: string;
-    /** Authentication credentials */
-    auth: ParticipationAuth;
-    /** IDs of nodes this participant can execute */
-    allowedNodeIds: string[];
-    /** Current participation status */
-    status: ParticipationStatus;
-    /** When the participant authenticated */
-    authenticatedAt?: Date;
-    /** Last activity timestamp */
-    lastActivityAt?: Date;
-    /** Completed node IDs */
-    completedNodeIds: string[];
-    /** Timestamps */
+    /** Email of the user who has access */
+    grantedTo: string;
+    /** Scope of access: ["*"] for full access, or ["node:xyz"] for specific nodes */
+    scope: string[];
+    /** Array of JWT IDs (jti) that have been revoked */
+    revokedTokenJtis: string[];
+    /** When the entire grant was revoked (null if active) */
+    revokedAt?: Date;
+    /** When this grant expires */
+    validUntil: Date;
+    /** When the grant was created */
     createdAt: Date;
-    updatedAt: Date;
+    /** Last time the grant was used */
+    lastUsedAt?: Date;
+}
+/**
+ * Input for creating an access grant
+ */
+interface CreateGrantInput {
+    /** Invitation ID that originated this grant */
+    invitationId: string;
+    /** Instance ID to grant access to */
+    instanceId: string;
+    /** Email of the user getting access */
+    grantedTo: string;
+    /** Scope of access (default: ["*"]) */
+    scope?: string[];
+    /** Validity in days (default: 30) */
+    validDays?: number;
 }
 /**
- * Check if auth is signed link type
+ * Check if grant is still valid (not revoked, not expired)
  */
-declare function isSignedLinkAuth(auth: ParticipationAuth): auth is SignedLinkAuth;
+declare function isGrantValid(grant: WorkflowAccessGrant): boolean;
 /**
- * Check if auth is PIN code type
+ * Check if grant has been revoked
  */
-declare function isPinCodeAuth(auth: ParticipationAuth): auth is PinCodeAuth;
+declare function isGrantRevoked(grant: WorkflowAccessGrant): boolean;
 /**
- * Check if participation is active and can execute nodes
+ * Check if a specific token has been revoked
  */
-declare function canParticipate(participation: WorkflowParticipation): boolean;
+declare function isTokenRevoked(grant: WorkflowAccessGrant, jti: string): boolean;
 /**
- * Check if participation can be authenticated (pending and not expired)
+ * Check if grant has expired
  */
-declare function canAuthenticate(participation: WorkflowParticipation): boolean;
+declare function isGrantExpired(grant: WorkflowAccessGrant): boolean;
 /**
- * Check if a participation can execute a specific node
+ * Check if scope allows access to a specific node
  */
-declare function canExecuteNode(participation: WorkflowParticipation, nodeId: string): boolean;
+declare function canAccessNode(grant: WorkflowAccessGrant, nodeId: string): boolean;
 
 /**
  * Workflow access mode - determines how the user is authenticated
@@ -3379,7 +4274,7 @@ type WorkflowAccessMode = {
 } | {
     type: "external";
     token: string;
-    participationId: string;
+    grantId: string;
 };
 /**
  * Reason why a field is read-only
@@ -3727,8 +4622,7 @@ interface DBWorkflow {
     slots: WorkflowSlot[];
     nodes: Record<string, WorkflowNode>;
     start_node_id: string;
-    layout: WorkflowLayout;
-    participants: ParticipantTemplate[] | null;
+    layout?: WorkflowLayout;
     theme: WorkflowTheme | null;
     config: WorkflowConfig | null;
     system: boolean;
@@ -3750,8 +4644,7 @@ interface CreateDBWorkflow {
     slots: WorkflowSlot[];
     nodes: Record<string, WorkflowNode>;
     startNodeId: string;
-    layout: WorkflowLayout;
-    participants?: ParticipantTemplate[];
+    layout?: WorkflowLayout;
     theme?: WorkflowTheme;
     config?: WorkflowConfig;
     system?: boolean;
@@ -3770,7 +4663,6 @@ interface UpdateDBWorkflow {
     nodes?: Record<string, WorkflowNode>;
     startNodeId?: string;
     layout?: WorkflowLayout;
-    participants?: ParticipantTemplate[];
     theme?: WorkflowTheme;
     config?: WorkflowConfig;
     metadata?: Record<string, unknown>;
@@ -3835,51 +4727,77 @@ interface UpdateDBWorkflowInstance {
     completedAt?: Date | null;
 }
 /**
- * Workflow participation as stored in database.
+ * Workflow invitation as stored in database.
  * Uses snake_case to match database column names.
  */
-interface DBWorkflowParticipation {
+interface DBWorkflowInvitation {
     id: string;
     tenant_id: string;
     instance_id: string;
-    participant_template_id: string;
-    type: "internal" | "external";
-    email: string;
-    name: string | null;
-    phone: string | null;
-    auth: ParticipationAuth;
-    allowed_node_ids: string[];
-    status: ParticipationStatus;
-    authenticated_at: string | null;
-    last_activity_at: string | null;
-    completed_node_ids: string[];
+    recipient_email: string;
+    recipient_name: string | null;
+    status: InvitationStatus;
+    created_by: string;
     created_at: string;
-    updated_at: string;
+    accepted_at: string | null;
+    expires_at: string;
 }
 /**
- * Data for creating a workflow participation.
+ * Data for creating a workflow invitation.
  * Tenant ID is automatically set from the execution context.
  */
-interface CreateDBWorkflowParticipation {
+interface CreateDBWorkflowInvitation {
     instanceId: string;
-    participantTemplateId: string;
-    type: "internal" | "external";
-    email: string;
-    name?: string;
-    phone?: string;
-    auth: ParticipationAuth;
-    allowedNodeIds: string[];
-    status?: ParticipationStatus;
+    recipientEmail: string;
+    recipientName?: string;
+    status?: InvitationStatus;
+    createdBy: string;
+    expiresAt: Date;
+}
+/**
+ * Data for updating a workflow invitation.
+ */
+interface UpdateDBWorkflowInvitation {
+    status?: InvitationStatus;
+    acceptedAt?: Date | null;
+    expiresAt?: Date;
+}
+/**
+ * Workflow access grant as stored in database.
+ * Uses snake_case to match database column names.
+ */
+interface DBWorkflowAccessGrant {
+    id: string;
+    tenant_id: string;
+    invitation_id: string;
+    instance_id: string;
+    granted_to: string;
+    scope: string[];
+    revoked_token_jtis: string[];
+    created_at: string;
+    last_used_at: string | null;
+    valid_until: string;
+    revoked_at: string | null;
+}
+/**
+ * Data for creating a workflow access grant.
+ * Tenant ID is automatically set from the execution context.
+ */
+interface CreateDBWorkflowAccessGrant {
+    invitationId: string;
+    instanceId: string;
+    grantedTo: string;
+    scope?: string[];
+    revokedTokenJtis?: string[];
+    validUntil: Date;
 }
 /**
- * Data for updating a workflow participation.
+ * Data for updating a workflow access grant.
  */
-interface UpdateDBWorkflowParticipation {
-    status?: ParticipationStatus;
-    auth?: ParticipationAuth;
-    authenticatedAt?: Date | null;
-    lastActivityAt?: Date | null;
-    completedNodeIds?: string[];
+interface UpdateDBWorkflowAccessGrant {
+    lastUsedAt?: Date;
+    revokedTokenJtis?: string[];
+    revokedAt?: Date | null;
 }
 /**
  * Result of an operation
@@ -4800,6 +5718,26 @@ declare const rollupConfigSchema: z.ZodObject<{
         }>>;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
+/**
+ * Document attribute config schema
+ */
+declare const documentConfigSchema: z.ZodObject<{
+    disabled: z.ZodOptional<z.ZodBoolean>;
+    placeholder: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    defaultValue: z.ZodOptional<z.ZodUnknown>;
+    icon: z.ZodOptional<z.ZodString>;
+    order: z.ZodOptional<z.ZodNumber>;
+    hidden: z.ZodOptional<z.ZodBoolean>;
+    archived: z.ZodOptional<z.ZodBoolean>;
+    deprecated: z.ZodOptional<z.ZodBoolean>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    templateId: z.ZodOptional<z.ZodString>;
+    allowedTemplates: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    multiple: z.ZodOptional<z.ZodBoolean>;
+    maxDocuments: z.ZodOptional<z.ZodNumber>;
+    autoProcess: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
 /**
  * Map of attribute type to config schema
  */
@@ -5905,45 +6843,76 @@ interface WorkflowInstancesRepository {
  * All operations are automatically scoped to the current tenant
  * from the execution context (via AsyncLocalStorage).
  */
-interface WorkflowParticipationsRepository {
+/**
+ * Repository for workflow invitations.
+ *
+ * All operations are automatically scoped to the current tenant
+ * from the execution context (via AsyncLocalStorage).
+ */
+interface WorkflowInvitationsRepository {
     /**
-     * Find participation by ID.
+     * Find invitation by ID.
      * Automatically filtered by current tenant context.
      */
-    findById(id: Uuid): Promise<DBWorkflowParticipation | null>;
+    findById(id: Uuid): Promise<DBWorkflowInvitation | null>;
     /**
-     * Find participations by instance ID.
+     * Find invitations by instance ID.
      * Automatically filtered by current tenant context.
      */
-    findByInstanceId(instanceId: Uuid): Promise<DBWorkflowParticipation[]>;
+    findByInstanceId(instanceId: Uuid): Promise<DBWorkflowInvitation[]>;
     /**
-     * Find participations by email.
+     * Find invitations by recipient email.
      * Automatically filtered by current tenant context.
      */
-    findByEmail(email: string): Promise<DBWorkflowParticipation[]>;
+    findByEmail(email: string): Promise<DBWorkflowInvitation[]>;
     /**
-     * Create participation.
+     * Create invitation.
      * Tenant ID is automatically set from context.
      */
-    create(data: CreateDBWorkflowParticipation): Promise<DBWorkflowParticipation>;
+    create(data: CreateDBWorkflowInvitation): Promise<DBWorkflowInvitation>;
+    /**
+     * Update invitation.
+     * Automatically filtered by current tenant context.
+     */
+    update(id: Uuid, data: UpdateDBWorkflowInvitation): Promise<DBWorkflowInvitation>;
+}
+/**
+ * Repository for workflow access grants.
+ *
+ * All operations are automatically scoped to the current tenant
+ * from the execution context (via AsyncLocalStorage).
+ */
+interface WorkflowAccessGrantsRepository {
+    /**
+     * Find grant by ID.
+     * Automatically filtered by current tenant context.
+     */
+    findById(id: Uuid): Promise<DBWorkflowAccessGrant | null>;
     /**
-     * Update participation.
+     * Find grants by invitation ID.
      * Automatically filtered by current tenant context.
      */
-    update(id: Uuid, data: Partial<UpdateDBWorkflowParticipation>): Promise<DBWorkflowParticipation>;
+    findByInvitationId(invitationId: Uuid): Promise<DBWorkflowAccessGrant[]>;
     /**
-     * Upsert participation (create or update based on ID).
+     * Find grants by instance ID.
+     * Automatically filtered by current tenant context.
+     */
+    findByInstanceId(instanceId: Uuid): Promise<DBWorkflowAccessGrant[]>;
+    /**
+     * Find grants by email.
+     * Automatically filtered by current tenant context.
+     */
+    findByEmail(email: string): Promise<DBWorkflowAccessGrant[]>;
+    /**
+     * Create grant.
      * Tenant ID is automatically set from context.
      */
-    upsert(data: CreateDBWorkflowParticipation & {
-        id: string;
-    }): Promise<DBWorkflowParticipation>;
+    create(data: CreateDBWorkflowAccessGrant): Promise<DBWorkflowAccessGrant>;
     /**
-     * Update only the auth field of a participation.
-     * Used for recording failed PIN attempts without touching other fields.
+     * Update grant.
      * Automatically filtered by current tenant context.
      */
-    updateAuth(id: Uuid, auth: ParticipationAuth): Promise<void>;
+    update(id: Uuid, data: UpdateDBWorkflowAccessGrant): Promise<DBWorkflowAccessGrant>;
 }
 /**
  * Repository for audit logs.
@@ -6213,7 +7182,256 @@ interface AIUsageMetricsRepository {
 }
 
 /**
- * File content type - supports various formats
+ * Repository for document templates.
+ *
+ * Templates define the structure of documents (slots, processing, etc.).
+ * System templates are available to all tenants.
+ * Custom templates are tenant-specific.
+ *
+ * All operations are automatically scoped to the current tenant
+ * from the execution context (via AsyncLocalStorage).
+ */
+interface DocumentTemplatesRepository {
+    /**
+     * Find template by ID.
+     * Returns system templates or tenant-specific templates.
+     */
+    findById(id: Uuid): Promise<DocumentTemplate | null>;
+    /**
+     * Find template by name.
+     * First checks tenant-specific templates, then falls back to system templates.
+     */
+    findByName(name: string): Promise<DocumentTemplate | null>;
+    /**
+     * Find multiple templates by names.
+     */
+    findByNames(names: string[]): Promise<DocumentTemplate[]>;
+    /**
+     * List all available templates.
+     * Includes both system templates and tenant-specific templates.
+     */
+    list(options?: DocumentTemplateListOptions): Promise<DocumentTemplate[]>;
+    /**
+     * Create a custom template.
+     * Tenant ID is automatically set from context.
+     */
+    create(data: CreateDocumentTemplate): Promise<DocumentTemplate>;
+    /**
+     * Update a template.
+     * Only tenant-specific templates can be updated.
+     */
+    update(id: Uuid, data: UpdateDocumentTemplate): Promise<DocumentTemplate>;
+    /**
+     * Delete a template.
+     * Only tenant-specific templates can be deleted.
+     */
+    delete(id: Uuid): Promise<void>;
+}
+/**
+ * Repository for documents.
+ *
+ * Documents are wrappers around files with templates, slots, and processing.
+ * They are linked to records via record.values (document attribute).
+ *
+ * All operations are automatically scoped to the current tenant
+ * from the execution context (via AsyncLocalStorage).
+ */
+interface DocumentsRepository {
+    /**
+     * Create a new document.
+     * Tenant ID is automatically set from context.
+     */
+    create(data: CreateDocument): Promise<Document>;
+    /**
+     * Find document by ID.
+     * Automatically filtered by current tenant context.
+     */
+    findById(id: Uuid): Promise<Document | null>;
+    /**
+     * Find multiple documents by IDs.
+     * Automatically filtered by current tenant context.
+     */
+    findByIds(ids: Uuid[]): Promise<Document[]>;
+    /**
+     * Update a document.
+     * Automatically filtered by current tenant context.
+     */
+    update(id: Uuid, data: UpdateDocument): Promise<Document>;
+    /**
+     * Update document status.
+     * Convenience method for status transitions.
+     */
+    updateStatus(id: Uuid, status: DocumentStatus): Promise<Document>;
+    /**
+     * Soft delete a document.
+     * Automatically filtered by current tenant context.
+     */
+    delete(id: Uuid): Promise<void>;
+    /**
+     * Hard delete a document.
+     * Automatically filtered by current tenant context.
+     */
+    hardDelete(id: Uuid): Promise<void>;
+    /**
+     * List documents with optional filters.
+     * Automatically filtered by current tenant context.
+     */
+    list(options?: DocumentListOptions): Promise<Document[]>;
+    /**
+     * Search documents by text.
+     * Uses full-text search on title, description, and OCR content.
+     */
+    search(query: string, options?: DocumentListOptions): Promise<Document[]>;
+}
+/**
+ * Repository for document slots.
+ *
+ * Slots are individual file entries within a document.
+ * Each slot corresponds to a slot definition in the template.
+ */
+interface DocumentSlotsRepository {
+    /**
+     * Create a slot (upload a file to a document).
+     */
+    create(data: CreateDocumentSlot): Promise<DocumentSlot>;
+    /**
+     * Find slot by ID.
+     */
+    findById(id: Uuid): Promise<DocumentSlot | null>;
+    /**
+     * Find all slots for a document.
+     */
+    findByDocumentId(documentId: Uuid): Promise<DocumentSlot[]>;
+    /**
+     * Find a specific slot by document and slot name.
+     */
+    findByDocumentAndSlot(documentId: Uuid, slotName: string): Promise<DocumentSlot | null>;
+    /**
+     * Update a slot (status, OCR results, etc.).
+     */
+    update(id: Uuid, data: UpdateDocumentSlot): Promise<DocumentSlot>;
+    /**
+     * Update slot status.
+     */
+    updateStatus(id: Uuid, status: SlotStatus): Promise<DocumentSlot>;
+    /**
+     * Delete a slot.
+     */
+    delete(id: Uuid): Promise<void>;
+    /**
+     * Delete all slots for a document.
+     */
+    deleteByDocumentId(documentId: Uuid): Promise<void>;
+}
+/**
+ * Repository for document processing jobs.
+ *
+ * Jobs track async processing tasks (OCR, signature, verification).
+ * They are linked to documents and optionally to specific slots.
+ */
+interface DocumentJobsRepository {
+    /**
+     * Create a processing job.
+     * Tenant ID is automatically set from context.
+     */
+    create(data: CreateProcessingJob): Promise<ProcessingJob>;
+    /**
+     * Find job by ID.
+     */
+    findById(id: Uuid): Promise<ProcessingJob | null>;
+    /**
+     * Find all jobs for a document.
+     */
+    findByDocumentId(documentId: Uuid): Promise<ProcessingJob[]>;
+    /**
+     * Find jobs by status (for processing queue).
+     */
+    findByStatus(status: ProcessingJobStatus, limit?: number): Promise<ProcessingJob[]>;
+    /**
+     * Find pending jobs (for processing queue).
+     */
+    findPending(limit?: number): Promise<ProcessingJob[]>;
+    /**
+     * Update a job.
+     */
+    update(id: Uuid, data: UpdateProcessingJob): Promise<ProcessingJob>;
+    /**
+     * Mark job as started.
+     */
+    markStarted(id: Uuid): Promise<ProcessingJob>;
+    /**
+     * Mark job as completed with result.
+     */
+    markCompleted(id: Uuid, result: Record<string, unknown>): Promise<ProcessingJob>;
+    /**
+     * Mark job as failed with error.
+     */
+    markFailed(id: Uuid, error: string): Promise<ProcessingJob>;
+    /**
+     * Cancel a job.
+     */
+    cancel(id: Uuid): Promise<ProcessingJob>;
+    /**
+     * Find job by external ID (e.g., signature provider ID).
+     * Used for webhook callbacks.
+     */
+    findByExternalId?(externalId: string): Promise<ProcessingJob | null>;
+}
+/**
+ * List options for document generation templates
+ */
+interface DocumentGenerationTemplateListOptions {
+    /** Filter by source type */
+    sourceType?: "pdf" | "docx";
+    /** Limit results */
+    limit?: number;
+    /** Offset for pagination */
+    offset?: number;
+}
+/**
+ * Repository for document generation templates.
+ *
+ * Document generation templates define how to generate documents by injecting
+ * workflow context data into PDF or DOCX template files.
+ *
+ * All operations are automatically scoped to the current tenant
+ * from the execution context (via AsyncLocalStorage).
+ */
+interface DocumentGenerationTemplatesRepository {
+    /**
+     * Find template by ID.
+     * Automatically filtered by current tenant context.
+     */
+    findById(id: Uuid): Promise<DocumentGenerationTemplate | null>;
+    /**
+     * Find template by name.
+     * Automatically filtered by current tenant context.
+     */
+    findByName(name: string): Promise<DocumentGenerationTemplate | null>;
+    /**
+     * List all templates for current tenant.
+     * Automatically filtered by current tenant context.
+     */
+    list(options?: DocumentGenerationTemplateListOptions): Promise<DocumentGenerationTemplate[]>;
+    /**
+     * Create template.
+     * Tenant ID is automatically set from context.
+     */
+    create(data: CreateDocumentGenerationTemplate): Promise<DocumentGenerationTemplate>;
+    /**
+     * Update template.
+     * Automatically filtered by current tenant context.
+     */
+    update(id: Uuid, data: UpdateDocumentGenerationTemplate): Promise<DocumentGenerationTemplate>;
+    /**
+     * Delete template.
+     * Automatically filtered by current tenant context.
+     */
+    delete(id: Uuid): Promise<void>;
+}
+
+/**
+ * File content type - supports various formats
  * Use Uint8Array for cross-platform compatibility
  */
 type FileContent = Uint8Array | ArrayBuffer | Blob | ReadableStream<Uint8Array>;
@@ -6369,6 +7587,16 @@ interface StorageAdapter {
      * @returns true if file exists
      */
     exists?(storagePath: string): Promise<boolean>;
+    /**
+     * Download file content from storage
+     *
+     * Optional method - required for document processing features.
+     * If not implemented, processing features will be unavailable.
+     *
+     * @param storagePath - Path to the file in storage
+     * @returns File content as Buffer
+     */
+    download?(storagePath: string): Promise<Buffer>;
 }
 /**
  * Input for FileService.uploadFile() method
@@ -6439,7 +7667,8 @@ interface DatabaseAdapter {
     views: ViewsRepository;
     workflows?: WorkflowsRepository;
     workflowInstances?: WorkflowInstancesRepository;
-    workflowParticipations?: WorkflowParticipationsRepository;
+    workflowInvitations?: WorkflowInvitationsRepository;
+    workflowAccessGrants?: WorkflowAccessGrantsRepository;
     userProfiles: UserProfilesRepository;
     files: FilesRepository;
     objectRecords: ObjectRecordsRepository;
@@ -6450,154 +7679,177 @@ interface DatabaseAdapter {
     aiConversations?: AIConversationsRepository;
     aiUserMemory?: AIUserMemoryRepository;
     aiUsageMetrics?: AIUsageMetricsRepository;
+    documents?: DocumentsRepository;
+    documentTemplates?: DocumentTemplatesRepository;
+    documentSlots?: DocumentSlotsRepository;
+    documentJobs?: DocumentJobsRepository;
+    documentGenerationTemplates?: DocumentGenerationTemplatesRepository;
     transaction<T>(callback: (adapter: DatabaseAdapter) => Promise<T>): Promise<T>;
 }
 
 /**
- * Payload encoded in the participation token
+ * Base JWT claims for workflow tokens
  */
-interface ParticipationTokenPayload {
-    /** Participation ID */
-    participationId: string;
-    /** Instance ID */
-    instanceId: string;
-    /** Tenant ID */
-    tenantId: string;
-    /** Expiration timestamp (unix ms) */
+interface BaseWorkflowClaims extends JWTPayload {
+    /** Issuer */
+    iss: string;
+    /** Audience (tenant ID) */
+    aud: string;
+    /** Subject (invitation or grant ID) */
+    sub: string;
+    /** Expiration timestamp */
     exp: number;
-    /** Issued at timestamp (unix ms) */
+    /** Issued at timestamp */
     iat: number;
-    /** Token ID (for revocation) */
+    /** JWT ID (for revocation) */
     jti: string;
 }
 /**
- * Options for token generation
+ * Magic link JWT payload (one-time use for accepting invitation)
  */
-interface TokenGenerationOptions {
-    /** Expiration duration (e.g., "7d", "24h", "1h") */
-    expiresIn?: string;
+interface MagicLinkPayload extends BaseWorkflowClaims {
+    /** Token type */
+    typ: "magic_link";
+    /** Workflow instance ID */
+    instance: string;
+    /** Tenant ID */
+    tenant: string;
 }
 /**
- * Result of token verification
+ * Access token JWT payload (long-lived for accessing workflow)
  */
-interface TokenVerificationResult {
+interface WorkflowAccessPayload extends BaseWorkflowClaims {
+    /** Token type */
+    typ: "workflow_access";
+    /** Grant ID */
+    sub: string;
+    /** Workflow instance ID */
+    instance: string;
+    /** Tenant ID */
+    tenant: string;
+    /** Access scope */
+    scope: string[];
+}
+type WorkflowJwtPayload = MagicLinkPayload | WorkflowAccessPayload;
+interface JwtVerificationResult {
     valid: boolean;
-    payload?: ParticipationTokenPayload;
+    payload?: WorkflowJwtPayload;
     error?: string;
+    errorCode?: "EXPIRED" | "INVALID_SIGNATURE" | "MALFORMED" | "UNKNOWN";
+}
+interface WorkflowJwtConfig {
+    /** Private key for signing (PEM string or CryptoKey) */
+    privateKey: string | CryptoKey;
+    /** Public key for verification (PEM string or CryptoKey) */
+    publicKey: string | CryptoKey;
+    /** Issuer claim (default: "stndrds/workflows") */
+    issuer?: string;
+    /** Access token TTL (default: "7d") */
+    accessTokenTTL?: string;
+    /** Magic link TTL (default: "15m") */
+    magicLinkTTL?: string;
 }
 /**
- * Service for generating and verifying participation tokens.
+ * Service for generating and verifying workflow JWT tokens.
  *
- * This is a minimal implementation that encodes data in base64.
- * In production, this should use proper JWT with HMAC/RSA signing.
+ * Uses ES256 (ECDSA with P-256 curve) for signing, which is:
+ * - More secure than HMAC (asymmetric)
+ * - Smaller signatures than RSA
+ * - Edge-runtime compatible (via jose)
  *
- * The signing key should be injected from environment configuration.
+ * @example
+ * ```typescript
+ * const jwtService = await WorkflowJwtService.create({
+ *   privateKey: process.env.WORKFLOW_JWT_PRIVATE_KEY!,
+ *   publicKey: process.env.WORKFLOW_JWT_PUBLIC_KEY!,
+ * });
+ *
+ * // Generate magic link
+ * const token = await jwtService.signMagicLink({
+ *   invitationId: "inv_123",
+ *   instanceId: "inst_456",
+ *   tenantId: "tenant_789",
+ * });
+ *
+ * // Verify token
+ * const result = await jwtService.verify(token);
+ * if (result.valid && result.payload?.typ === "magic_link") {
+ *   // Handle magic link
+ * }
+ * ```
  */
-declare class ParticipationTokenService {
-    private secret;
-    constructor(secret?: string);
-    /**
-     * Generate a participation token (signed link)
-     */
-    generateToken(participation: Pick<WorkflowParticipation, "id" | "instanceId"> & {
-        tenantId: string;
-    }, options?: TokenGenerationOptions): SignedLinkAuth;
+declare class WorkflowJwtService {
+    private config;
+    private privateKey;
+    private publicKey;
+    private issuer;
+    private accessTokenTTL;
+    private magicLinkTTL;
+    private initialized;
+    private constructor();
     /**
-     * Verify a participation token
+     * Create and initialize the JWT service.
+     * Handles async key import from PEM strings.
      */
-    verifyToken(token: string): TokenVerificationResult;
+    static create(config: WorkflowJwtConfig): Promise<WorkflowJwtService>;
+    private initialize;
     /**
-     * Generate a shareable link URL
-     */
-    generateLink(baseUrl: string, token: string): string;
-    /**
-     * Extract token from a participation link
+     * Sign a magic link JWT (one-time use, short-lived)
+     *
+     * @param params - Magic link parameters
+     * @returns Signed JWT token
      */
-    extractTokenFromLink(url: string): string | null;
-    private encodeToken;
-    private decodeToken;
-    private sign;
-    private parseExpiration;
-    private base64Encode;
-    private base64Decode;
-}
-/**
- * Get the default token service instance
- */
-declare function getDefaultTokenService(): ParticipationTokenService;
-/**
- * Initialize the token service with a custom secret
- */
-declare function initializeTokenService(secret: string): ParticipationTokenService;
-
-/**
- * Options for PIN code generation
- */
-interface PinCodeGenerationOptions {
-    /** Length of the PIN code (default: 6) */
-    length?: number;
-    /** Expiration duration (e.g., "24h", "7d") */
-    expiresIn?: string;
-    /** Maximum attempts before lockout (default: 3) */
-    maxAttempts?: number;
-}
-/**
- * Result of PIN code verification
- */
-interface PinCodeVerificationResult {
-    valid: boolean;
-    error?: string;
-    attemptsRemaining?: number;
-    lockedUntil?: Date;
-}
-/**
- * Service for generating and verifying PIN codes.
- *
- * PIN codes are hashed before storage for security.
- * This implementation uses a simple hash for demonstration.
- * In production, use bcrypt or argon2.
- */
-declare class PinCodeService {
-    private salt;
-    constructor(salt?: string);
+    signMagicLink(params: {
+        invitationId: string;
+        instanceId: string;
+        tenantId: string;
+        expiresIn?: string;
+    }): Promise<string>;
     /**
-     * Generate a PIN code and its auth object
+     * Sign an access token JWT (long-lived)
+     *
+     * @param params - Access token parameters
+     * @returns Signed JWT token
      */
-    generate(options?: PinCodeGenerationOptions): {
-        code: string;
-        auth: PinCodeAuth;
-    };
+    signAccessToken(params: {
+        grantId: string;
+        instanceId: string;
+        tenantId: string;
+        scope: string[];
+        expiresIn?: string;
+    }): Promise<string>;
     /**
-     * Verify a PIN code against stored auth
+     * Verify and decode a JWT token.
+     *
+     * Returns a result object with:
+     * - valid: boolean
+     * - payload: the decoded payload if valid
+     * - error: human-readable error message if invalid
+     * - errorCode: machine-readable error code if invalid
+     *
+     * @param token - JWT token to verify
+     * @returns Verification result
      */
-    verify(inputCode: string, auth: PinCodeAuth): PinCodeVerificationResult;
+    verify(token: string): Promise<JwtVerificationResult>;
     /**
-     * Record a failed attempt and return updated auth
+     * Verify token and return payload directly.
+     * Throws on invalid token.
+     *
+     * @param token - JWT token to verify
+     * @returns Decoded payload
+     * @throws Error if token is invalid
      */
-    recordFailedAttempt(auth: PinCodeAuth): PinCodeAuth;
+    verifyOrThrow(token: string): Promise<WorkflowJwtPayload>;
+    private handleVerifyError;
     /**
-     * Reset attempts (after successful verification or admin reset)
+     * Generate a magic link URL from a token
      */
-    resetAttempts(auth: PinCodeAuth): PinCodeAuth;
+    generateMagicLinkUrl(baseUrl: string, token: string): string;
     /**
-     * Generate a new PIN code (for resend functionality)
+     * Extract token from a magic link URL
      */
-    regenerate(auth: PinCodeAuth, options?: PinCodeGenerationOptions): {
-        code: string;
-        auth: PinCodeAuth;
-    };
-    private generateNumericCode;
-    private hashCode;
-    private parseExpiration;
+    extractTokenFromUrl(url: string): string | null;
 }
-/**
- * Get the default PIN code service instance
- */
-declare function getDefaultPinCodeService(): PinCodeService;
-/**
- * Initialize the PIN code service with a custom salt
- */
-declare function initializePinCodeService(salt: string): PinCodeService;
 
 /**
  * Formatted record with values flattened to root level.
@@ -6648,6 +7900,8 @@ interface QueryBuilderState {
     includeDeleted: boolean;
     /** Group results by attribute (for Kanban views - status/select only) */
     groupBy?: string;
+    /** Full-text search query */
+    search?: string;
     /** Explicit tenant ID (overrides AsyncLocalStorage context) */
     tenantId?: TenantId;
     /** Explicit user ID (overrides AsyncLocalStorage context) */
@@ -8901,7 +10155,7 @@ declare function createContextForRestore(schema: ObjectDefinition, tenantId: str
 
 /**
  * Fluent query builder for schema records.
- * Supports chained filters, sorts, and pagination.
+ * Supports chained filters, sorts, pagination, and full-text search.
  *
  * @example
  * ```typescript
@@ -8912,6 +10166,12 @@ declare function createContextForRestore(schema: ObjectDefinition, tenantId: str
  *   .limit(20)
  *   .fetch();
  *
+ * // Full-text search
+ * const results = await qb
+ *   .search('nike air')
+ *   .limit(20)
+ *   .fetch();
+ *
  * // Get single record
  * const product = await qb.eq('sku', 'ABC-123').single();
  *
@@ -9030,6 +10290,27 @@ declare class QueryBuilder<T extends Record<string, unknown> = Record<string, un
      * Include soft-deleted records
      */
     withDeleted(): QueryBuilder<T, TRaw>;
+    /**
+     * Full-text search across record fields.
+     * Can be combined with filters, sorts, and pagination.
+     *
+     * @example
+     * ```typescript
+     * // Search with pagination
+     * const products = await qb
+     *   .search("nike air")
+     *   .orderBy("createdAt", "desc")
+     *   .limit(20)
+     *   .fetch();
+     *
+     * // Search with filters
+     * const activeNikeProducts = await qb
+     *   .search("nike")
+     *   .eq("status", "active")
+     *   .fetch();
+     * ```
+     */
+    search(query: string): QueryBuilder<T, TRaw>;
     /**
      * Group results by an attribute (for Kanban views).
      * Only status and select attributes are supported.
@@ -9720,6 +11001,36 @@ declare class ConditionExecutor implements NodeExecutor<ConditionNode> {
     validate(node: ConditionNode): string[];
 }
 
+/**
+ * Executor for DocumentNode.
+ *
+ * This executor handles document generation nodes. It validates the node configuration
+ * and creates a pending document request in the execution context.
+ *
+ * The actual document generation is delegated to the consumer (NestJS, Supabase, etc.)
+ * which processes pending document requests before advancing to the next node.
+ *
+ * Behavior:
+ * - Validates that templateId is set
+ * - Creates a pending document request in context.documents
+ * - Returns success with the next node ID
+ *
+ * The consumer is responsible for:
+ * 1. Detecting pending document requests (status: "pending")
+ * 2. Loading the template from DocumentGenerationTemplatesRepository
+ * 3. Resolving variable values from the execution context
+ * 4. Generating the PDF using pdf-lib
+ * 5. Uploading the generated document to storage
+ * 6. Attaching to target records via DocumentsRepository
+ * 7. Updating context.documents with the final URL and metadata
+ */
+declare class DocumentExecutor implements NodeExecutor<DocumentNode> {
+    readonly nodeType: "document";
+    execute(node: DocumentNode, _context: ExecutorContext): ExecutorResult;
+    canExecute(_node: DocumentNode, _context: ExecutorContext): boolean;
+    validate(node: DocumentNode): string[];
+}
+
 /**
  * Executor for EndNode.
  * Marks the workflow as completed with an optional status.
@@ -10128,7 +11439,8 @@ interface MockStores {
     userRoles: Map<Uuid, UserRoleAssignment>;
     workflows: Map<Uuid, DBWorkflow>;
     workflowInstances: Map<Uuid, DBWorkflowInstance>;
-    workflowParticipations: Map<Uuid, DBWorkflowParticipation>;
+    workflowInvitations: Map<Uuid, DBWorkflowInvitation>;
+    workflowAccessGrants: Map<Uuid, DBWorkflowAccessGrant>;
     aiConversations: Map<Uuid, AIConversation>;
     aiMessages: Map<Uuid, AIMessage>;
     aiUserMemory: Map<string, AIUserMemory>;
@@ -10190,51 +11502,882 @@ declare function createMockAdapter(): DatabaseAdapter & {
 declare const notesPolicy: RecordPolicy;
 
 /**
- * Input for creating a workflow
+ * Document Generation Service
+ *
+ * Manages document generation templates used in workflow document nodes.
+ * Templates define how to generate PDF documents by injecting workflow
+ * context data into PDF template files.
  */
-interface CreateWorkflowInput {
-    name: string;
-    label: string;
-    description?: string;
-    icon?: IconName;
-    slots: WorkflowSlot[];
-    nodes: Record<string, WorkflowNode>;
-    startNodeId: string;
-    layout: WorkflowLayout;
-    participants?: ParticipantTemplate[];
-    theme?: WorkflowTheme;
-    config?: WorkflowConfig;
-    metadata?: Record<string, unknown>;
-}
+
 /**
- * Input for updating a workflow
+ * Error thrown when document generation template is not found
  */
-interface UpdateWorkflowInput {
-    label?: string;
-    description?: string;
-    icon?: IconName;
-    slots?: WorkflowSlot[];
-    nodes?: Record<string, WorkflowNode>;
-    startNodeId?: string;
-    layout?: WorkflowLayout;
-    participants?: ParticipantTemplate[];
-    theme?: WorkflowTheme;
-    config?: WorkflowConfig;
-    metadata?: Record<string, unknown>;
+declare class DocumentGenerationTemplateNotFoundError extends Error {
+    readonly templateId: string;
+    constructor(templateId: string);
 }
 /**
- * Options for WorkflowService constructor
+ * Error thrown when document generation templates repository is not available
  */
-interface WorkflowServiceOptions {
-    /**
-     * System workflows to register (in-memory, not from database).
-     */
-    systemWorkflows?: WorkflowDefinition[];
+declare class DocumentGenerationNotConfiguredError extends Error {
+    constructor();
 }
 /**
- * Service for managing workflow definitions.
- * Handles fusion of system workflows (from registry) and custom workflows (from database).
- * Automatically uses tenant context from AsyncLocalStorage.
+ * Service for managing document generation templates.
+ *
+ * Used by:
+ * - Workflow builder UI (create/edit templates)
+ * - Workflow document nodes (load template for generation)
+ * - NestJS controller (CRUD API)
+ *
+ * @example
+ * ```typescript
+ * const service = new DocumentGenerationService(adapter);
+ *
+ * // Create a new template
+ * const template = await service.create({
+ *   name: "sales-contract",
+ *   label: "Sales Contract",
+ *   source: {
+ *     type: "pdf",
+ *     fileId: "file_123",
+ *     fields: [
+ *       { id: "f1", page: 0, x: 100, y: 200, width: 150, height: 20, contextPath: "slots.client.name", label: "Client Name" }
+ *     ]
+ *   }
+ * });
+ *
+ * // Get template for workflow execution
+ * const template = await service.getById(templateId);
+ * ```
+ */
+declare class DocumentGenerationService extends BaseService {
+    /**
+     * Get the document generation templates repository.
+     * @throws DocumentGenerationNotConfiguredError if repository not available
+     */
+    private get repo();
+    /**
+     * Get a template by ID.
+     *
+     * @param id - Template ID
+     * @returns Template or null if not found
+     */
+    getById(id: Uuid): Promise<DocumentGenerationTemplate | null>;
+    /**
+     * Get a template by ID, throwing if not found.
+     *
+     * @param id - Template ID
+     * @returns Template
+     * @throws DocumentGenerationTemplateNotFoundError if not found
+     */
+    getByIdOrThrow(id: Uuid): Promise<DocumentGenerationTemplate>;
+    /**
+     * Get a template by name.
+     *
+     * @param name - Template name (unique within tenant)
+     * @returns Template or null if not found
+     */
+    getByName(name: string): Promise<DocumentGenerationTemplate | null>;
+    /**
+     * List templates for the current tenant.
+     *
+     * @param options - List options (sourceType filter, pagination)
+     * @returns Array of templates
+     */
+    list(options?: {
+        sourceType?: "pdf" | "docx";
+        limit?: number;
+        offset?: number;
+    }): Promise<DocumentGenerationTemplate[]>;
+    /**
+     * Create a new document generation template.
+     *
+     * @param input - Template data
+     * @returns Created template
+     */
+    create(input: CreateDocumentGenerationTemplate): Promise<DocumentGenerationTemplate>;
+    /**
+     * Update a template.
+     *
+     * @param id - Template ID
+     * @param input - Fields to update
+     * @returns Updated template
+     */
+    update(id: Uuid, input: UpdateDocumentGenerationTemplate): Promise<DocumentGenerationTemplate>;
+    /**
+     * Delete a template.
+     *
+     * @param id - Template ID
+     */
+    delete(id: Uuid): Promise<void>;
+}
+
+/**
+ * Options for FileService constructor
+ */
+interface FileServiceOptions {
+    /**
+     * Audit service for logging file operations.
+     * If provided, audit logging is enabled using userId from context.
+     * If not provided, no audit logs are created (backward compatible).
+     */
+    auditService?: AuditService;
+}
+/**
+ * Service for managing files.
+ *
+ * Handles file metadata CRUD, permissions, storage operations, and audit logging.
+ * Works with optional StorageAdapter for file upload/download operations.
+ * Automatically uses tenant context from AsyncLocalStorage.
+ *
+ * @example
+ * ```typescript
+ * // Basic usage (metadata only)
+ * const service = new FileService(adapter);
+ *
+ * // With audit logging
+ * const auditService = new AuditService(adapter);
+ * const service = new FileService(adapter, { auditService });
+ *
+ * // Upload file (requires StorageAdapter)
+ * const file = await service.uploadFile({
+ *   content: fileBuffer,
+ *   fileName: "contract.pdf",
+ *   mimeType: "application/pdf",
+ *   size: 12345,
+ *   uploadedBy: "user-456",
+ * });
+ * ```
+ */
+declare class FileService extends BaseService {
+    private auditService?;
+    constructor(adapter: DatabaseAdapter, options?: FileServiceOptions);
+    /**
+     * Upload a file to storage and create metadata record.
+     *
+     * This method orchestrates:
+     * 1. Upload to storage (via StorageAdapter)
+     * 2. Create file metadata in database
+     * 3. Audit log the operation
+     *
+     * Requires `adapter.storage` to be configured.
+     *
+     * @param input - File content and metadata
+     * @returns Created file record
+     * @throws Error if StorageAdapter is not configured
+     *
+     * @example
+     * ```typescript
+     * const file = await service.uploadFile({
+     *   content: fileBuffer,
+     *   fileName: "document.pdf",
+     *   mimeType: "application/pdf",
+     *   size: 12345,
+     *   uploadedBy: "user-123",
+     *   visibility: "private",
+     *   folderPath: "/documents",
+     *   tags: ["contract", "2025"],
+     * });
+     * ```
+     */
+    uploadFile(input: UploadFileInput): Promise<File>;
+    /**
+     * Create a new file record (after upload to storage).
+     *
+     * Use this method when handling storage externally (e.g., with Multer + S3).
+     * For integrated upload, use `uploadFile()` instead.
+     *
+     * @param data - File metadata
+     * @returns Created file record
+     *
+     * @example
+     * ```typescript
+     * // After uploading to S3 with Multer
+     * const file = await service.createFile({
+     *   tenantId: "tenant-123",
+     *   name: "contract-2025.pdf",
+     *   originalName: "Contract Acme Corp 2025.pdf",
+     *   mimeType: "application/pdf",
+     *   size: 2458624,
+     *   storageProvider: "s3",
+     *   storagePath: "tenants/123/files/2025/contract.pdf",
+     *   storageBucket: "my-app-files",
+     *   url: "https://cdn.example.com/files/file-123",
+     *   uploadedBy: "profile-456",
+     *   visibility: "private"
+     * });
+     * ```
+     */
+    createFile(data: CreateFile): Promise<File>;
+    /**
+     * Get file by ID
+     */
+    getFile(fileId: string): Promise<File | null>;
+    /**
+     * Get file by ID or throw
+     */
+    getFileOrThrow(fileId: string): Promise<File>;
+    /**
+     * Update file metadata
+     *
+     * @param fileId - File UUID
+     * @param data - Data to update
+     * @returns Updated file
+     */
+    updateFile(fileId: string, data: UpdateFile): Promise<File>;
+    /**
+     * Delete file (soft delete by default)
+     *
+     * @param fileId - File UUID
+     * @param options - Delete options
+     */
+    deleteFile(fileId: string, options?: {
+        hard?: boolean;
+        checkOwnership?: boolean;
+        userId?: string;
+    }): Promise<void>;
+    /**
+     * Delete file from both storage and database.
+     *
+     * Requires `adapter.storage` to be configured.
+     *
+     * @param fileId - File UUID
+     * @param options - Delete options
+     * @throws Error if StorageAdapter is not configured
+     */
+    deleteFileWithStorage(fileId: string, options?: {
+        hard?: boolean;
+    }): Promise<void>;
+    /**
+     * Delete multiple files
+     *
+     * @param fileIds - Array of file UUIDs
+     * @param options - Delete options
+     */
+    bulkDelete(fileIds: string[], options?: {
+        hard?: boolean;
+        deleteFromStorage?: boolean;
+    }): Promise<void>;
+    /**
+     * List files for the tenant
+     */
+    listFiles(options?: FileListOptions): Promise<File[]>;
+    /**
+     * List files by folder
+     */
+    listFilesByFolder(folderPath: string): Promise<File[]>;
+    /**
+     * List files uploaded by a specific user
+     */
+    listFilesByUploader(uploadedBy: string): Promise<File[]>;
+    /**
+     * Get a signed URL for private file access.
+     *
+     * Checks access permissions before generating URL.
+     * Requires `adapter.storage` to be configured.
+     *
+     * @param fileId - File UUID
+     * @param userId - User requesting access
+     * @param options - Signed URL options
+     * @returns Signed URL
+     * @throws Error if user doesn't have access or StorageAdapter is not configured
+     *
+     * @example
+     * ```typescript
+     * const url = await service.getSignedUrl("file-123", "user-456", {
+     *   expiresIn: 3600, // 1 hour
+     * });
+     * ```
+     */
+    getSignedUrl(fileId: string, userId: string, options?: SignedUrlOptions): Promise<string>;
+    /**
+     * Check if user has access to a file
+     *
+     * @param fileId - File UUID
+     * @param userId - User ID to check
+     * @returns true if user can access the file
+     */
+    checkAccess(fileId: string, userId: string): Promise<boolean>;
+    /**
+     * @deprecated Use checkAccess() instead
+     */
+    canAccess(fileId: string, userId: string): Promise<boolean>;
+    /**
+     * Change file visibility
+     *
+     * @param fileId - File UUID
+     * @param visibility - New visibility level
+     * @param allowedUsers - Users allowed to access (if restricted)
+     */
+    changeVisibility(fileId: string, visibility: FileVisibility, allowedUsers?: string[]): Promise<File>;
+    /**
+     * Grant access to a file for specific users
+     *
+     * @param fileId - File UUID
+     * @param userIds - User IDs to grant access
+     */
+    grantAccess(fileId: string, userIds: string[]): Promise<File>;
+    /**
+     * Revoke access to a file for specific users
+     *
+     * @param fileId - File UUID
+     * @param userIds - User IDs to revoke access
+     */
+    revokeAccess(fileId: string, userIds: string[]): Promise<File>;
+    /**
+     * Move file to different folder
+     */
+    moveToFolder(fileId: string, newFolderPath: string): Promise<File>;
+    /**
+     * Add tags to file
+     */
+    addTags(fileId: string, tags: string[]): Promise<File>;
+    /**
+     * Remove tags from file
+     */
+    removeTags(fileId: string, tags: string[]): Promise<File>;
+}
+
+/**
+ * Service for managing document templates.
+ *
+ * Templates define the structure of documents (slots, auto-processing, etc.).
+ * System templates are defined in code and available to all tenants.
+ * Custom templates can be created by tenants for specific needs.
+ *
+ * @example
+ * ```typescript
+ * const service = new DocumentTemplateService(adapter);
+ *
+ * // Get a template by name (checks custom first, then system)
+ * const template = await service.getTemplateByName("french_id_card");
+ *
+ * // List all available templates
+ * const templates = await service.listTemplates();
+ *
+ * // Create a custom template
+ * const customTemplate = await service.createTemplate({
+ *   name: "company_contract",
+ *   label: "Contrat d'entreprise",
+ *   slots: [{ name: "contract", label: "Contrat", required: true, order: 1 }],
+ * });
+ * ```
+ */
+declare class DocumentTemplateService extends BaseService {
+    constructor(adapter: DatabaseAdapter);
+    /**
+     * Get a template by ID.
+     * Checks custom templates first, then system templates.
+     */
+    getTemplate(templateId: string): Promise<DocumentTemplate | null>;
+    /**
+     * Get a template by name.
+     * Checks custom templates first (tenant-specific), then system templates.
+     */
+    getTemplateByName(name: string): Promise<DocumentTemplate | null>;
+    /**
+     * Get multiple templates by names.
+     */
+    getTemplatesByNames(names: string[]): Promise<DocumentTemplate[]>;
+    /**
+     * Get a template or throw if not found.
+     */
+    getTemplateOrThrow(templateId: string): Promise<DocumentTemplate>;
+    /**
+     * Get a template by name or throw if not found.
+     */
+    getTemplateByNameOrThrow(name: string): Promise<DocumentTemplate>;
+    /**
+     * List all available templates.
+     * Includes both system templates and tenant-specific templates.
+     */
+    listTemplates(options?: DocumentTemplateListOptions): Promise<DocumentTemplate[]>;
+    /**
+     * Get only system templates.
+     */
+    getSystemTemplates(): DocumentTemplate[];
+    /**
+     * Create a custom template.
+     * System templates cannot be created via this method.
+     */
+    createTemplate(data: CreateDocumentTemplate): Promise<DocumentTemplate>;
+    /**
+     * Update a custom template.
+     * System templates cannot be updated.
+     */
+    updateTemplate(templateId: string, data: UpdateDocumentTemplate): Promise<DocumentTemplate>;
+    /**
+     * Delete a custom template.
+     * System templates cannot be deleted.
+     */
+    deleteTemplate(templateId: string): Promise<void>;
+}
+
+interface RecordDocumentsResult {
+    /** Documents grouped by attribute name (includes system 'attachments' attribute) */
+    byAttribute: Record<string, Document[]>;
+    /** Total count of all documents */
+    total: number;
+}
+interface CreateRecordDocumentInput {
+    /** Object name (used for folder path) */
+    objectName: string;
+    /** Record ID (used for folder path) */
+    recordId: string;
+    /** File content */
+    fileContent: Buffer;
+    /** Original file name */
+    fileName: string;
+    /** MIME type */
+    mimeType: string;
+    /** File size */
+    fileSize: number;
+    /** User ID who uploads */
+    uploadedBy: string;
+    /** Optional document title (defaults to fileName) */
+    title?: string;
+    /** Optional template ID (defaults to generic_document) */
+    templateId?: string;
+}
+interface CreateRecordDocumentResult {
+    document: Document;
+    file: {
+        id: string;
+        url?: string;
+    };
+    slot: DocumentSlot;
+}
+interface DocumentServiceOptions {
+    /**
+     * Template service instance.
+     * If not provided, a new one will be created.
+     */
+    templateService?: DocumentTemplateService;
+    /**
+     * File service instance (required for createRecordDocument).
+     */
+    fileService?: FileService;
+}
+/**
+ * Service for managing documents.
+ *
+ * Documents are structured wrappers around files with:
+ * - Template-based structure (slots)
+ * - Status tracking (draft, pending, processing, completed, failed, signed)
+ * - Processing jobs (OCR, signature, verification)
+ *
+ * Documents are linked to records via `record.values` (document attribute).
+ *
+ * @example
+ * ```typescript
+ * const service = new DocumentService(adapter);
+ *
+ * // Create a document
+ * const document = await service.createDocument({
+ *   templateId: SYSTEM_TEMPLATE_IDS.FRENCH_ID_CARD,
+ *   title: "CNI - Jean Dupont",
+ * });
+ *
+ * // Add files to slots
+ * await service.addSlot(document.id, {
+ *   slotName: "front",
+ *   fileId: "file-123",
+ * });
+ *
+ * // Get document with slots
+ * const doc = await service.getDocument(document.id);
+ * const slots = await service.getSlots(document.id);
+ * ```
+ */
+declare class DocumentService extends BaseService {
+    private templateService;
+    private fileService;
+    constructor(adapter: DatabaseAdapter, options?: DocumentServiceOptions);
+    /**
+     * Create a new document.
+     *
+     * @param data - Document creation data
+     * @returns Created document with status "draft"
+     */
+    createDocument(data: CreateDocument): Promise<Document>;
+    /**
+     * Create a document with a template name instead of ID.
+     */
+    createDocumentByTemplateName(templateName: string, data: Omit<CreateDocument, "templateId">): Promise<Document>;
+    /**
+     * Get a document by ID.
+     */
+    getDocument(documentId: string): Promise<Document | null>;
+    /**
+     * Get a document by ID or throw if not found.
+     */
+    getDocumentOrThrow(documentId: string): Promise<Document>;
+    /**
+     * Get multiple documents by IDs.
+     */
+    getDocuments(documentIds: string[]): Promise<Document[]>;
+    /**
+     * Get the template for a document.
+     */
+    getDocumentTemplate(documentId: string): Promise<DocumentTemplate>;
+    /**
+     * List documents with optional filters.
+     */
+    listDocuments(options?: DocumentListOptions): Promise<Document[]>;
+    /**
+     * Search documents by text.
+     */
+    searchDocuments(query: string, options?: DocumentListOptions): Promise<Document[]>;
+    /**
+     * Update a document's metadata.
+     */
+    updateDocument(documentId: string, data: {
+        title?: string;
+        description?: string;
+        tags?: string[];
+    }): Promise<Document>;
+    /**
+     * Update document status.
+     * This is usually called automatically based on slots and jobs.
+     */
+    updateStatus(documentId: string, status: DocumentStatus): Promise<Document>;
+    /**
+     * Soft delete a document.
+     */
+    deleteDocument(documentId: string): Promise<void>;
+    /**
+     * Hard delete a document and all its slots.
+     */
+    hardDeleteDocument(documentId: string): Promise<void>;
+    /**
+     * Get all slots for a document.
+     */
+    getSlots(documentId: string): Promise<DocumentSlot[]>;
+    /**
+     * Add a file to a document slot.
+     */
+    addSlot(documentId: string, data: Omit<CreateDocumentSlot, "documentId">): Promise<DocumentSlot>;
+    /**
+     * Remove a slot from a document.
+     */
+    removeSlot(slotId: string): Promise<void>;
+    /**
+     * Recalculate and update document status based on slots and jobs.
+     *
+     * Status flow:
+     * - draft: Missing required slots
+     * - pending: All required slots filled, no processing started
+     * - processing: At least one job is pending or processing
+     * - completed: All jobs completed successfully (no signature)
+     * - signed: Signature job completed successfully
+     * - failed: At least one job failed
+     */
+    recalculateStatus(documentId: string): Promise<Document>;
+    /**
+     * Check if a document is complete (all required slots filled).
+     */
+    isComplete(documentId: string): Promise<boolean>;
+    /**
+     * Get document with its template and slots.
+     */
+    getDocumentWithDetails(documentId: string): Promise<{
+        document: Document;
+        template: DocumentTemplate;
+        slots: DocumentSlot[];
+    }>;
+    /**
+     * Get all documents attached to a record.
+     *
+     * Retrieves documents from document attributes in record values.
+     * This includes the system 'attachments' attribute for free-form documents.
+     *
+     * @param schema - Object schema with attributes
+     * @param recordValues - Record values containing document IDs
+     */
+    getRecordDocuments(schema: ObjectDefinition, recordValues: Record<string, unknown>): Promise<RecordDocumentsResult>;
+    /**
+     * Create a document for a record.
+     *
+     * This method:
+     * 1. Uploads the file
+     * 2. Creates a document with the specified template
+     * 3. Adds the file to the document slot
+     *
+     * Note: The caller is responsible for updating record.values with the document ID.
+     *
+     * @param input - Document creation input
+     */
+    createRecordDocument(input: CreateRecordDocumentInput): Promise<CreateRecordDocumentResult>;
+}
+
+/**
+ * Document Processing Hook
+ *
+ * Processes pending document generation requests in workflow execution context.
+ * Called after each node execution to fulfill document generation.
+ */
+
+/**
+ * Options for the document processing hook
+ */
+interface DocumentProcessingHookOptions {
+    /** Document generation service for loading templates */
+    documentGenerationService: DocumentGenerationService;
+    /** Document service for creating record documents */
+    documentService?: DocumentService;
+    /** Record service for updating records with attachments */
+    recordService?: RecordService;
+    /** Schema service for attribute definitions (enables intelligent formatting) */
+    schemaService?: ObjectSchemaService;
+    /** Relation service for resolving relation labels */
+    relationService?: RelationService;
+}
+/**
+ * Hook for processing pending document generation requests.
+ *
+ * This hook is called after each node execution in WorkflowInstanceService.
+ * It detects pending document requests in context.documents and:
+ * 1. Loads the template
+ * 2. Renders the PDF using DocumentRendererService
+ * 3. Uploads the generated PDF
+ * 4. Attaches to target records
+ * 5. Updates context.documents with the result
+ *
+ * @example
+ * ```typescript
+ * const hook = new DocumentProcessingHook(
+ *   adapter,
+ *   storageAdapter,
+ *   {
+ *     documentGenerationService,
+ *     documentService,
+ *     recordService,c
+ *   }
+ * );
+ *
+ * // In WorkflowInstanceService.executeCurrentNode()
+ * const processedContext = await hook.process(context, workflow, userId);
+ * ```
+ */
+declare class DocumentProcessingHook extends BaseService {
+    readonly adapter: DatabaseAdapter;
+    private readonly storageAdapter;
+    private readonly options;
+    private readonly renderer;
+    constructor(adapter: DatabaseAdapter, storageAdapter: StorageAdapter, options: DocumentProcessingHookOptions);
+    /**
+     * Process all pending document requests in the context.
+     *
+     * @param context - Current workflow execution context
+     * @param workflow - Workflow definition (for slot/object info)
+     * @param userId - User ID for audit/permissions
+     * @returns Updated context with processed documents
+     */
+    process(context: WorkflowExecutionContext, workflow: WorkflowDefinition, userId: string): Promise<WorkflowExecutionContext>;
+    /**
+     * Find node IDs with pending document requests
+     */
+    private findPendingDocuments;
+    /**
+     * Upload the generated PDF to storage
+     */
+    private uploadGeneratedDocument;
+    /**
+     * Attach generated document to target records
+     */
+    private attachToRecords;
+}
+
+declare class GrantNotFoundError extends Error {
+    grantId: string;
+    constructor(grantId: string);
+}
+declare class GrantExpiredError extends Error {
+    grantId: string;
+    constructor(grantId: string);
+}
+declare class GrantRevokedError extends Error {
+    grantId: string;
+    constructor(grantId: string);
+}
+declare class TokenRevokedError extends Error {
+    grantId: string;
+    jti: string;
+    constructor(grantId: string, jti: string);
+}
+interface GrantServiceConfig {
+    /** Default grant validity in days (default: 30) */
+    defaultValidityDays?: number;
+    /** Access token TTL (default: "7d") */
+    accessTokenTTL?: string;
+}
+interface CreateGrantResult {
+    grant: WorkflowAccessGrant;
+    accessToken: string;
+}
+/**
+ * Service for managing workflow access grants.
+ *
+ * Grants are created after a user successfully authenticates via magic link.
+ * They allow the user to access the workflow with JWT access tokens.
+ *
+ * Key features:
+ * - Grants have an expiration date (validUntil)
+ * - Grants can be revoked entirely (revokedAt)
+ * - Individual tokens can be revoked (revokedTokenJtis)
+ *
+ * @example
+ * ```typescript
+ * const grantService = new WorkflowAccessGrantService(adapter, jwtService, {
+ *   defaultValidityDays: 30,
+ * });
+ *
+ * // Create grant after magic link acceptance
+ * const { grant, accessToken } = await grantService.createGrant({
+ *   invitationId: "inv_123",
+ *   instanceId: "inst_456",
+ *   grantedTo: "client@example.com",
+ * });
+ *
+ * // Later: revoke a specific token
+ * await grantService.revokeToken(grant.id, "jti_to_revoke");
+ *
+ * // Or revoke the entire grant
+ * await grantService.revokeGrant(grant.id);
+ * ```
+ */
+declare class WorkflowAccessGrantService extends BaseService {
+    private jwtService;
+    private config;
+    constructor(adapter: DatabaseAdapter, jwtService: WorkflowJwtService, config?: GrantServiceConfig);
+    /**
+     * Find grant by ID
+     */
+    findById(id: Uuid): Promise<WorkflowAccessGrant | null>;
+    /**
+     * Find grants by invitation ID
+     */
+    findByInvitationId(invitationId: Uuid): Promise<WorkflowAccessGrant[]>;
+    /**
+     * Find grants by instance ID
+     */
+    findByInstanceId(instanceId: Uuid): Promise<WorkflowAccessGrant[]>;
+    /**
+     * Find grants by email
+     */
+    findByEmail(email: string): Promise<WorkflowAccessGrant[]>;
+    /**
+     * Create a new access grant and generate an access token.
+     *
+     * This is called after a magic link has been successfully verified.
+     */
+    createGrant(input: CreateGrantInput): Promise<CreateGrantResult>;
+    /**
+     * Revoke an entire grant.
+     *
+     * After revocation, all tokens issued for this grant will be invalid.
+     */
+    revokeGrant(grantId: Uuid): Promise<WorkflowAccessGrant>;
+    /**
+     * Revoke a specific token by its JTI.
+     *
+     * This allows revoking a single token without invalidating other tokens.
+     * Useful for logout or token refresh scenarios.
+     */
+    revokeToken(grantId: Uuid, jti: string): Promise<WorkflowAccessGrant>;
+    /**
+     * Update the last used timestamp for a grant.
+     */
+    updateLastUsed(grantId: Uuid): Promise<void>;
+    /**
+     * Issue a new access token for an existing grant.
+     *
+     * Used for token refresh scenarios.
+     */
+    refreshAccessToken(grantId: Uuid): Promise<{
+        accessToken: string;
+        grant: WorkflowAccessGrant;
+    }>;
+    /**
+     * Validate that a grant is still valid (sync version for internal use).
+     * Throws appropriate error if validation fails.
+     */
+    validateGrantSync(dbGrant: DBWorkflowAccessGrant): void;
+    /**
+     * Validate that a grant is still valid by ID.
+     * Fetches the grant and validates it.
+     */
+    validateGrant(grantId: Uuid): Promise<WorkflowAccessGrant>;
+    /**
+     * Validate that a specific token is still valid.
+     * Calls validateGrantSync first, then checks token-specific revocation.
+     */
+    validateTokenSync(dbGrant: DBWorkflowAccessGrant, jti: string): void;
+    /**
+     * Validate that a specific token is still valid by grant ID.
+     * Fetches the grant and validates both grant and token.
+     */
+    validateToken(grantId: Uuid, jti: string): Promise<void>;
+    /**
+     * Check if a specific token has been revoked.
+     */
+    isTokenRevoked(dbGrant: DBWorkflowAccessGrant, jti: string): boolean;
+    /**
+     * Validate access token payload against the grant.
+     */
+    validateAccessPayload(payload: WorkflowAccessPayload): Promise<{
+        valid: boolean;
+        grant?: WorkflowAccessGrant;
+        error?: string;
+    }>;
+    private mapFromDB;
+}
+
+/**
+ * Input for creating a workflow
+ */
+interface CreateWorkflowInput {
+    name: string;
+    label: string;
+    description?: string;
+    icon?: IconName;
+    slots: WorkflowSlot[];
+    nodes: Record<string, WorkflowNode>;
+    startNodeId: string;
+    layout?: WorkflowLayout;
+    theme?: WorkflowTheme;
+    config?: WorkflowConfig;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Input for updating a workflow
+ */
+interface UpdateWorkflowInput {
+    label?: string;
+    description?: string;
+    icon?: IconName;
+    slots?: WorkflowSlot[];
+    nodes?: Record<string, WorkflowNode>;
+    startNodeId?: string;
+    layout?: WorkflowLayout;
+    theme?: WorkflowTheme;
+    config?: WorkflowConfig;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Options for WorkflowService constructor
+ */
+interface WorkflowServiceOptions {
+    /**
+     * System workflows to register (in-memory, not from database).
+     */
+    systemWorkflows?: WorkflowDefinition[];
+}
+/**
+ * Service for managing workflow definitions.
+ * Handles fusion of system workflows (from registry) and custom workflows (from database).
+ * Automatically uses tenant context from AsyncLocalStorage.
  *
  * Supports optional caching via CacheAdapter for improved performance.
  * Cache is automatically invalidated when workflows are modified.
@@ -10337,6 +12480,8 @@ interface WorkflowInstanceServiceOptions {
     schemaService?: ObjectSchemaService;
     /** Record service for persisting slots at workflow completion */
     recordService?: RecordService;
+    /** Document processing hook for generating PDFs in document nodes */
+    documentProcessingHook?: DocumentProcessingHook;
 }
 /**
  * Service for executing and managing workflow instances.
@@ -10347,6 +12492,7 @@ declare class WorkflowInstanceService extends BaseService {
     private executorRegistry;
     private schemaService?;
     private recordService?;
+    private documentProcessingHook?;
     constructor(adapter: DatabaseAdapter, workflowService: WorkflowService, options?: WorkflowInstanceServiceOptions);
     /**
      * Start a new workflow instance
@@ -10447,85 +12593,101 @@ declare class WorkflowInstanceService extends BaseService {
     private convertDBInstanceToInstance;
 }
 
-/**
- * Input for creating a participation
- */
-interface CreateParticipationInput {
-    /** Workflow instance ID */
-    instanceId: string;
-    /** Participant template ID */
-    participantTemplateId: string;
-    /** Override email (if not using emailSource) */
-    email?: string;
-    /** Override name */
-    name?: string;
-    /** Override phone */
-    phone?: string;
-    /** Override auth method */
-    authMethod?: "signed_link" | "pin_code";
-}
-/**
- * Result of creating a participation
- */
-interface CreateParticipationResult {
-    participation: WorkflowParticipation;
-    /** For signed_link: the shareable URL */
-    link?: string;
-    /** For pin_code: the plain PIN (only returned once!) */
-    pinCode?: string;
-}
-/**
- * Result of authentication
- */
-interface AuthenticationResult {
-    success: boolean;
-    participation?: WorkflowParticipation;
-    error?: string;
-    attemptsRemaining?: number;
-}
-/**
- * Service for managing external participant access to workflow instances.
- * Handles invitation, authentication, and participation tracking.
+interface InvitationServiceConfig {
+    /** Base URL for the magic link (e.g., "https://app.example.com") */
+    baseUrl: string;
+    /** Default invitation expiry in days (default: 7) */
+    defaultExpiryDays?: number;
+    /** Callback to send notification email */
+    sendEmailCallback?: (params: {
+        recipientEmail: string;
+        recipientName?: string;
+        magicLink: string;
+        instanceId: string;
+    }) => Promise<void>;
+}
+declare class InvitationNotFoundError extends Error {
+    invitationId: string;
+    constructor(invitationId: string);
+}
+declare class InvitationExpiredError extends Error {
+    invitationId: string;
+    constructor(invitationId: string);
+}
+declare class InvitationAlreadyAcceptedError extends Error {
+    invitationId: string;
+    constructor(invitationId: string);
+}
+declare class InvitationRevokedError extends Error {
+    invitationId: string;
+    constructor(invitationId: string);
+}
+/**
+ * Service for managing workflow invitations.
+ *
+ * Invitations are the first step in the external user authentication flow:
+ * 1. Admin creates an invitation → generates magic link
+ * 2. External user clicks magic link → invitation is accepted
+ * 3. Grant is created → user gets access token
+ *
+ * @example
+ * ```typescript
+ * const invitationService = new WorkflowInvitationService(adapter, jwtService, {
+ *   baseUrl: "https://app.example.com",
+ *   sendEmailCallback: async ({ recipientEmail, magicLink }) => {
+ *     await sendMagicLinkEmail(recipientEmail, magicLink);
+ *   },
+ * });
+ *
+ * const { invitation, magicLink } = await invitationService.createInvitation({
+ *   instanceId: "inst_123",
+ *   recipientEmail: "client@example.com",
+ *   recipientName: "John Doe",
+ *   sendEmail: true,
+ * });
+ * ```
  */
-declare class WorkflowParticipationService extends BaseService {
-    private instanceService;
-    private tokenService;
-    private pinCodeService;
-    constructor(adapter: DatabaseAdapter, instanceService: WorkflowInstanceService, tokenService?: ParticipationTokenService, pinCodeService?: PinCodeService);
+declare class WorkflowInvitationService extends BaseService {
+    private jwtService;
+    private config;
+    constructor(adapter: DatabaseAdapter, jwtService: WorkflowJwtService, config: InvitationServiceConfig);
     /**
-     * Create a participation for an external user
+     * Find invitation by ID
      */
-    createParticipation(input: CreateParticipationInput, baseUrl: string): Promise<CreateParticipationResult>;
+    findById(id: Uuid): Promise<WorkflowInvitation | null>;
     /**
-     * Authenticate using a signed link token
+     * Find invitations by instance ID
      */
-    authenticateWithToken(token: string): Promise<AuthenticationResult>;
+    findByInstanceId(instanceId: Uuid): Promise<WorkflowInvitation[]>;
     /**
-     * Authenticate using a PIN code
+     * Find invitations by recipient email
      */
-    authenticateWithPin(participationId: string, pinCode: string): Promise<AuthenticationResult>;
+    findByEmail(email: string): Promise<WorkflowInvitation[]>;
     /**
-     * Get a participation by ID
+     * Create a new invitation and generate a magic link.
+     *
+     * Optionally sends an email notification to the recipient.
      */
-    getParticipation(id: string): Promise<WorkflowParticipation | null>;
+    createInvitation(input: CreateInvitationInput): Promise<CreateInvitationResult>;
     /**
-     * Get participations for an instance
+     * Mark an invitation as accepted.
+     *
+     * This is called internally when a magic link is exchanged for an access token.
+     * It should not be called directly.
      */
-    getParticipationsForInstance(instanceId: string): Promise<WorkflowParticipation[]>;
+    markAsAccepted(invitationId: Uuid): Promise<WorkflowInvitation>;
     /**
-     * Mark a node as completed by a participation
+     * Revoke an invitation.
+     *
+     * Once revoked, the magic link will no longer work.
      */
-    markNodeCompleted(participationId: string, nodeId: string): Promise<WorkflowParticipation>;
+    revoke(invitationId: Uuid): Promise<WorkflowInvitation>;
     /**
-     * Revoke a participation
+     * Validate that an invitation can be accepted.
+     * Throws appropriate error if validation fails.
      */
-    revokeParticipation(id: string): Promise<WorkflowParticipation>;
-    private resolveEmailFromContext;
-    private resolvePhoneFromContext;
-    private markAuthenticated;
-    private updateParticipationAuth;
-    private saveParticipation;
-    private convertDBToParticipation;
+    validateForAcceptance(dbInvitation: DBWorkflowInvitation): void;
+    private mapFromDB;
 }
 
 /**
@@ -10558,7 +12720,7 @@ interface FieldReadOnlyResult {
  * // Check if a field is read-only for external users
  * const { readOnly, reason } = service.isFieldReadOnly(
  *   userAttribute,
- *   { type: "external", token: "...", participationId: "..." }
+ *   { type: "external", token: "...", grantId: "..." }
  * );
  * ```
  */
@@ -10880,229 +13042,283 @@ declare class UserProfileService extends BaseService {
 declare function buildAuditChanges<T extends Record<string, unknown>>(oldValues: T, newValues: Partial<T>, fieldsToCheck: (keyof T)[]): AuditChange[];
 
 /**
- * Options for FileService constructor
+ * Configuration for document processing adapters.
+ * All adapters are optional - features are disabled if not provided.
  */
-interface FileServiceOptions {
-    /**
-     * Audit service for logging file operations.
-     * If provided, audit logging is enabled using userId from context.
-     * If not provided, no audit logs are created (backward compatible).
-     */
-    auditService?: AuditService;
+interface DocumentProcessingConfig {
+    /** OCR adapter for text extraction */
+    ocrAdapter?: OcrAdapter;
+    /** Signature adapter for electronic signatures */
+    signatureAdapter?: SignatureAdapter;
+    /** Identity verification adapter for KYC */
+    identityAdapter?: IdentityVerificationAdapter;
 }
 /**
- * Service for managing files.
+ * Service for orchestrating document processing jobs.
  *
- * Handles file metadata CRUD, permissions, storage operations, and audit logging.
- * Works with optional StorageAdapter for file upload/download operations.
- * Automatically uses tenant context from AsyncLocalStorage.
+ * This service is AGNOSTIC - it receives adapters via dependency injection.
+ * Concrete adapter implementations live in @stndrds/schema-nestjs or dedicated packages.
  *
  * @example
  * ```typescript
- * // Basic usage (metadata only)
- * const service = new FileService(adapter);
+ * // In NestJS, adapters are injected via DI
+ * const service = new DocumentProcessingService(adapter, {
+ *   ocrAdapter: googleVisionAdapter,
+ *   signatureAdapter: yousignAdapter,
+ *   identityAdapter: onfidoAdapter,
+ * });
  *
- * // With audit logging
- * const auditService = new AuditService(adapter);
- * const service = new FileService(adapter, { auditService });
+ * // Process OCR on a document slot
+ * const job = await service.processOcr(documentId, "front");
  *
- * // Upload file (requires StorageAdapter)
- * const file = await service.uploadFile({
- *   content: fileBuffer,
- *   fileName: "contract.pdf",
- *   mimeType: "application/pdf",
- *   size: 12345,
- *   uploadedBy: "user-456",
- * });
+ * // Start signature workflow
+ * const signJob = await service.startSignature(documentId, [
+ *   { email: "signer@example.com", firstName: "John", lastName: "Doe" }
+ * ]);
  * ```
  */
-declare class FileService extends BaseService {
-    private auditService?;
-    constructor(adapter: DatabaseAdapter, options?: FileServiceOptions);
+declare class DocumentProcessingService extends BaseService {
+    private readonly config;
+    private readonly documentService;
+    private readonly templateService;
+    constructor(adapter: DatabaseAdapter, config: DocumentProcessingConfig);
     /**
-     * Upload a file to storage and create metadata record.
-     *
-     * This method orchestrates:
-     * 1. Upload to storage (via StorageAdapter)
-     * 2. Create file metadata in database
-     * 3. Audit log the operation
-     *
-     * Requires `adapter.storage` to be configured.
-     *
-     * @param input - File content and metadata
-     * @returns Created file record
-     * @throws Error if StorageAdapter is not configured
+     * Process OCR on a document slot.
      *
-     * @example
-     * ```typescript
-     * const file = await service.uploadFile({
-     *   content: fileBuffer,
-     *   fileName: "document.pdf",
-     *   mimeType: "application/pdf",
-     *   size: 12345,
-     *   uploadedBy: "user-123",
-     *   visibility: "private",
-     *   folderPath: "/documents",
-     *   tags: ["contract", "2025"],
-     * });
-     * ```
+     * @param documentId - Document ID
+     * @param slotName - Slot name to process
+     * @returns Created processing job
      */
-    uploadFile(input: UploadFileInput): Promise<File>;
+    processOcr(documentId: string, slotName: string): Promise<ProcessingJob>;
     /**
-     * Create a new file record (after upload to storage).
-     *
-     * Use this method when handling storage externally (e.g., with Multer + S3).
-     * For integrated upload, use `uploadFile()` instead.
-     *
-     * @param data - File metadata
-     * @returns Created file record
-     *
-     * @example
-     * ```typescript
-     * // After uploading to S3 with Multer
-     * const file = await service.createFile({
-     *   tenantId: "tenant-123",
-     *   name: "contract-2025.pdf",
-     *   originalName: "Contract Acme Corp 2025.pdf",
-     *   mimeType: "application/pdf",
-     *   size: 2458624,
-     *   storageProvider: "s3",
-     *   storagePath: "tenants/123/files/2025/contract.pdf",
-     *   storageBucket: "my-app-files",
-     *   url: "https://cdn.example.com/files/file-123",
-     *   uploadedBy: "profile-456",
-     *   visibility: "private"
-     * });
-     * ```
+     * Execute pending OCR job.
+     * This is typically called by a background worker.
      */
-    createFile(data: CreateFile): Promise<File>;
+    executeOcrJob(jobId: string): Promise<ProcessingJob>;
     /**
-     * Get file by ID
+     * Start a signature workflow for a document.
+     *
+     * @param documentId - Document ID
+     * @param signers - List of signers
+     * @param options - Signature options
+     * @returns Created processing job
      */
-    getFile(fileId: string): Promise<File | null>;
+    startSignature(documentId: string, signers: SignerRequest[], options?: {
+        expiresAt?: Date;
+        webhookUrl?: string;
+    }): Promise<ProcessingJob>;
     /**
-     * Get file by ID or throw
+     * Execute pending signature job.
+     * This sends the document to the signature provider.
      */
-    getFileOrThrow(fileId: string): Promise<File>;
+    executeSignatureJob(jobId: string): Promise<ProcessingJob>;
     /**
-     * Update file metadata
+     * Handle signature webhook callback.
+     * Updates job status based on provider response.
      *
-     * @param fileId - File UUID
-     * @param data - Data to update
-     * @returns Updated file
+     * @param externalId - External ID from the signature provider
+     * @returns Updated job, or null if job not found
      */
-    updateFile(fileId: string, data: UpdateFile): Promise<File>;
+    handleSignatureWebhook(externalId: string): Promise<ProcessingJob | null>;
     /**
-     * Delete file (soft delete by default)
+     * Verify identity document.
      *
-     * @param fileId - File UUID
-     * @param options - Delete options
+     * @param documentId - Document ID (must be an identity document)
+     * @returns Created processing job
      */
-    deleteFile(fileId: string, options?: {
-        hard?: boolean;
-        checkOwnership?: boolean;
-        userId?: string;
-    }): Promise<void>;
+    verifyIdentity(documentId: string): Promise<ProcessingJob>;
     /**
-     * Delete file from both storage and database.
-     *
-     * Requires `adapter.storage` to be configured.
-     *
-     * @param fileId - File UUID
-     * @param options - Delete options
-     * @throws Error if StorageAdapter is not configured
+     * Execute pending identity verification job.
      */
-    deleteFileWithStorage(fileId: string, options?: {
-        hard?: boolean;
-    }): Promise<void>;
+    executeIdentityVerificationJob(jobId: string): Promise<ProcessingJob>;
     /**
-     * Delete multiple files
-     *
-     * @param fileIds - Array of file UUIDs
-     * @param options - Delete options
+     * Trigger auto-processing based on template configuration.
+     * Called after all required slots are uploaded.
      */
-    bulkDelete(fileIds: string[], options?: {
-        hard?: boolean;
-        deleteFromStorage?: boolean;
-    }): Promise<void>;
+    triggerAutoProcessing(documentId: string): Promise<ProcessingJob[]>;
     /**
-     * List files for the tenant
+     * Get all jobs for a document.
      */
-    listFiles(options?: FileListOptions): Promise<File[]>;
+    getJobsForDocument(documentId: string): Promise<ProcessingJob[]>;
     /**
-     * List files by folder
+     * Get pending jobs for processing.
      */
-    listFilesByFolder(folderPath: string): Promise<File[]>;
+    getPendingJobs(limit?: number): Promise<ProcessingJob[]>;
     /**
-     * List files uploaded by a specific user
+     * Cancel a pending job.
      */
-    listFilesByUploader(uploadedBy: string): Promise<File[]>;
+    cancelJob(jobId: string): Promise<ProcessingJob>;
     /**
-     * Get a signed URL for private file access.
-     *
-     * Checks access permissions before generating URL.
-     * Requires `adapter.storage` to be configured.
-     *
-     * @param fileId - File UUID
-     * @param userId - User requesting access
-     * @param options - Signed URL options
-     * @returns Signed URL
-     * @throws Error if user doesn't have access or StorageAdapter is not configured
-     *
-     * @example
-     * ```typescript
-     * const url = await service.getSignedUrl("file-123", "user-456", {
-     *   expiresIn: 3600, // 1 hour
-     * });
-     * ```
+     * Check if OCR is available.
      */
-    getSignedUrl(fileId: string, userId: string, options?: SignedUrlOptions): Promise<string>;
+    isOcrAvailable(): boolean;
     /**
-     * Check if user has access to a file
-     *
-     * @param fileId - File UUID
-     * @param userId - User ID to check
-     * @returns true if user can access the file
+     * Check if signature is available.
      */
-    checkAccess(fileId: string, userId: string): Promise<boolean>;
+    isSignatureAvailable(): boolean;
     /**
-     * @deprecated Use checkAccess() instead
+     * Check if identity verification is available.
      */
-    canAccess(fileId: string, userId: string): Promise<boolean>;
+    isIdentityVerificationAvailable(): boolean;
     /**
-     * Change file visibility
-     *
-     * @param fileId - File UUID
-     * @param visibility - New visibility level
-     * @param allowedUsers - Users allowed to access (if restricted)
+     * Get available processing capabilities.
      */
-    changeVisibility(fileId: string, visibility: FileVisibility, allowedUsers?: string[]): Promise<File>;
+    getCapabilities(): {
+        ocr: {
+            available: boolean;
+            provider?: string;
+        };
+        signature: {
+            available: boolean;
+            provider?: string;
+        };
+        identityVerification: {
+            available: boolean;
+            provider?: string;
+        };
+    };
+}
+
+/**
+ * Document Renderer Service
+ *
+ * Generates PDF documents by injecting workflow context data into PDF templates.
+ * Uses pdf-lib for PDF manipulation.
+ *
+ * Supports intelligent attribute formatting when SchemaService is provided:
+ * - Currency, dates, numbers formatted according to attribute config
+ * - Relations resolved to their display labels
+ * - Select/multiselect values resolved to option labels
+ */
+
+/**
+ * Input for rendering a document
+ */
+interface RenderDocumentInput {
+    /** The document generation template to use */
+    template: DocumentGenerationTemplate;
+    /** The workflow execution context containing the data */
+    context: WorkflowExecutionContext;
+    /** The workflow definition (for slot metadata) */
+    workflow?: WorkflowDefinition;
+    /** Custom filename (supports {{path}} interpolation) */
+    filename?: string;
+}
+/**
+ * Options for DocumentRendererService
+ */
+interface DocumentRendererOptions {
+    /** Schema service for attribute definitions (enables intelligent formatting) */
+    schemaService?: ObjectSchemaService;
+    /** Relation service for resolving relation labels */
+    relationService?: RelationService;
+    /** Files repository for resolving fileId to storagePath */
+    filesRepository?: FilesRepository;
+}
+/**
+ * Result of document rendering
+ */
+interface RenderDocumentResult {
+    /** The generated PDF as a buffer */
+    buffer: Buffer;
+    /** The resolved filename */
+    filename: string;
+    /** MIME type (always application/pdf) */
+    mimeType: "application/pdf";
+    /** Number of pages in the document */
+    pageCount: number;
+}
+/**
+ * Error thrown when document rendering fails
+ */
+declare class DocumentRenderError extends Error {
+    readonly templateId: string;
+    readonly cause?: unknown | undefined;
+    constructor(message: string, templateId: string, cause?: unknown | undefined);
+}
+/**
+ * Error thrown when storage adapter doesn't support download
+ */
+declare class StorageDownloadNotSupportedError extends Error {
+    constructor();
+}
+/**
+ * Service for rendering PDF documents from templates.
+ *
+ * Responsibilities:
+ * - Load template PDF from storage
+ * - Resolve field values from workflow context
+ * - Format values using attribute definitions (if available)
+ * - Resolve relation labels (if RelationService provided)
+ * - Inject text into PDF using pdf-lib
+ * - Return generated PDF buffer
+ *
+ * @example
+ * ```typescript
+ * // Basic usage
+ * const renderer = new DocumentRendererService(storageAdapter);
+ *
+ * // With intelligent formatting
+ * const renderer = new DocumentRendererService(storageAdapter, {
+ *   schemaService,
+ *   relationService,
+ * });
+ *
+ * const result = await renderer.render({
+ *   template,
+ *   context: workflowContext,
+ *   workflow: workflowDefinition,
+ *   filename: "contract-{{slots.client.name}}.pdf"
+ * });
+ * ```
+ */
+declare class DocumentRendererService {
+    private readonly storageAdapter;
+    private readonly options?;
+    private schemaCache;
+    constructor(storageAdapter: StorageAdapter, options?: DocumentRendererOptions | undefined);
     /**
-     * Grant access to a file for specific users
+     * Render a document from a template and context.
      *
-     * @param fileId - File UUID
-     * @param userIds - User IDs to grant access
+     * @param input - Template, context, and optional filename
+     * @returns Generated PDF buffer with metadata
+     * @throws DocumentRenderError if rendering fails
+     * @throws StorageDownloadNotSupportedError if storage doesn't support download
      */
-    grantAccess(fileId: string, userIds: string[]): Promise<File>;
+    render(input: RenderDocumentInput): Promise<RenderDocumentResult>;
     /**
-     * Revoke access to a file for specific users
-     *
-     * @param fileId - File UUID
-     * @param userIds - User IDs to revoke access
+     * Download the template PDF from storage
      */
-    revokeAccess(fileId: string, userIds: string[]): Promise<File>;
+    private downloadTemplate;
     /**
-     * Move file to different folder
+     * Resolve all field values, including relations and formatted attributes
      */
-    moveToFolder(fileId: string, newFolderPath: string): Promise<File>;
+    private resolveAllFieldValues;
     /**
-     * Add tags to file
+     * Get attribute info from contextPath
+     * Parses paths like "slots.client.firstName" to find the attribute definition
      */
-    addTags(fileId: string, tags: string[]): Promise<File>;
+    private getAttributeInfo;
     /**
-     * Remove tags from file
+     * Draw a single field on the PDF
      */
-    removeTags(fileId: string, tags: string[]): Promise<File>;
+    private drawField;
+    /**
+     * Simple value formatting (fallback when no attribute definition available)
+     */
+    private formatValueSimple;
+    /**
+     * Interpolate filename with context values
+     *
+     * Supports {{path}} syntax for variable interpolation.
+     *
+     * @example
+     * ```typescript
+     * interpolateFilename("contract-{{slots.client.name}}.pdf", context, template)
+     * // => "contract-John Doe.pdf"
+     * ```
+     */
+    private interpolateFilename;
 }
 
 /**
@@ -11550,4 +13766,4 @@ interface FullSyncOptions extends SyncOptions, ViewSyncOptions {
  */
 declare function syncAll(adapter: DatabaseAdapter, objectRegistry: typeof registry, nativeViewRegistry: typeof viewRegistry, options?: FullSyncOptions): Promise<FullSyncResult>;
 
-export { type FlowRow as $, type Attribute as A, type DirectTableTab as B, type CheckboxAttribute as C, type DateAttribute as D, type WorkflowConfig as E, type FileAttribute as F, type Group as G, type SlotMode as H, type InferAttributeValue as I, type AuthMethod as J, type AuthChannel as K, type LocationAttribute as L, type MultiselectAttribute as M, type NumberAttribute as N, type ObjectAction as O, type PhoneAttribute as P, type ParticipantTemplate as Q, type RichtextAttribute as R, type SystemResource as S, type TextAttribute as T, type UserAttribute as U, type ViewLayout as V, type WorkflowTheme as W, type ConditionGroup as X, type ConditionRule as Y, type WorkflowNode as Z, type WorkflowDefinition as _, type SystemAction as a, type FilterValue as a$, type AIMessageRole as a0, type AIThinkingLevel as a1, type AIToolCallStatus as a2, type AIToolCall as a3, type AIChatMessagePartType as a4, type TextPartData as a5, type ToolPartData as a6, type ThinkingPartData as a7, type ReasoningPartData as a8, type AIChatMessagePart as a9, RELATION_TARGET_ANY as aA, type RelationAttribute as aB, isUniversalRelation as aC, type AuditResourceType as aD, type AuditAction as aE, type AuditActorType as aF, type AuditChange as aG, type AuditLogEntry as aH, type CreateAuditLogInput as aI, type AuditListOptions as aJ, type AuditServiceOptions as aK, type StorageProvider as aL, type FileVisibility as aM, type File as aN, type CreateFile as aO, type UpdateFile as aP, type TextFilterOperator as aQ, type NumberFilterOperator as aR, type CheckboxFilterOperator as aS, type DateFilterOperator as aT, type SelectFilterOperator as aU, type MultiselectFilterOperator as aV, type RelationFilterOperator as aW, type FilterOperator as aX, type RelativeDateValue as aY, type CurrencyFilterValue as aZ, type PhoneFilterValue as a_, type AIChatMessage as aa, type AIQuestionType as ab, type AIQuestionOption as ac, type AIQuestion as ad, type AIQuestionAnswer as ae, type AITodoStatus as af, type AITodoItem as ag, type AITodoList as ah, type AIMessageAttachment as ai, type AIConversation as aj, type AIMessage as ak, type AIToolCallRecord as al, type AIUserMemory as am, type AIUsageMetrics as an, type AIProviderMetrics as ao, type CreateAIMessageInput as ap, type StatusGroup as aq, type AttributeGroup as ar, type BaseAttribute as as, type NumberUnit as at, type DateFormat as au, type DateValue as av, type Phone as aw, type Currency as ax, type Location as ay, type LocationGranularity as az, type TextAreaAttribute as b, type Permission as b$, type FilterRule as b0, type ExtendedFilterRule as b1, type FilterCombinator as b2, type FilterGroup as b3, type AdvancedFilterState as b4, isAdvancedFilterState as b5, toAdvancedFilterState as b6, toSimpleFilterState as b7, type SortDirection as b8, type QueryState as b9, type InferRecordInput as bA, type InferRecordUpdate as bB, type CustomAttributeValue as bC, type WithCustomAttributes as bD, type RecordMetadata as bE, type SystemFields as bF, type ExtractRecord as bG, type ExtractRecordStrict as bH, type ExtractRecordInput as bI, type ExtractRecordInputStrict as bJ, type ExtractRecordUpdate as bK, type ExtractRecordUpdateStrict as bL, type ExtractAttributes as bM, type TypedObjectRecord as bN, type ExtractObjectRecord as bO, type ExtractObjectRecordWithCustom as bP, RESERVED_ATTRIBUTE_NAMES as bQ, SYSTEM_FIELD_NAMES as bR, type ReservedAttributeName as bS, type SystemFieldName as bT, type Timestamps as bU, type SharingMode as bV, type ObjectAttribute as bW, type CompletionStatus as bX, type ObjectRecord as bY, type PermissionScope as bZ, type Role as b_, OPERATORS_BY_TYPE as ba, type NoValueOperator as bb, NO_VALUE_OPERATORS as bc, isNoValueOperator as bd, type FlowSlot as be, type FlowRowField as bf, type FlowPage as bg, type FlowRelation as bh, type FlowStatus as bi, type FlowDefinition as bj, isFlowDefinition as bk, isFlowPublished as bl, isSystemFlow as bm, type GeocodingSuggestion as bn, type GeocodingAutocompleteParams as bo, type ReverseGeocodingParams as bp, type GeocodingParams as bq, type GeocodingAdapter as br, NoopGeocodingAdapter as bs, type AttributeSchema as bt, type InferRecordFromSchema as bu, type InferRecordWithRequirements as bv, type TypedAttribute as bw, type AttributeMap as bx, type AddAttribute as by, type InferRecord as bz, type RichtextFeature as c, type WorkflowTransition as c$, type UserRoleAssignment as c0, type EffectivePermissions as c1, type ObjectPermissions as c2, type SystemPermissions as c3, type CreateRoleInput as c4, type UpdateRoleInput as c5, type CreatePermissionInput as c6, type AssignRoleInput as c7, type PolicyContext as c8, type RecordPolicy as c9, type WorkflowNodeType as cA, isStartNode as cB, isFormNode as cC, isConditionNode as cD, isEndNode as cE, isSimpleFormNode as cF, isAdvancedFormNode as cG, getNodeOutputs as cH, type ConditionOperator as cI, isConditionRule as cJ, isConditionGroup as cK, eq as cL, neq as cM, and as cN, or as cO, inValues as cP, isEmpty as cQ, isNotEmpty as cR, type WorkflowSlot as cS, type NodePosition as cT, type CanvasViewport as cU, type WorkflowLayout as cV, type ParticipantAuthConfig as cW, type WorkflowStatus as cX, isWorkflowDefinition as cY, isWorkflowPublished as cZ, isSystemWorkflow as c_, PolicyViolationError as ca, type UserRole as cb, type UserStatus as cc, type UserProfile as cd, type CreateUserProfile as ce, type UpdateUserProfile as cf, type InviteUserInput as cg, type TabType as ch, type FormTab as ci, type CustomTab as cj, type ActivityTab as ck, type NotesTab as cl, type FlowsTab as cm, isFormTab as cn, isTableTab as co, isDirectTableTab as cp, isInverseTableTab as cq, isCustomTab as cr, isActivityTab as cs, isNotesTab as ct, isFlowsTab as cu, type StartNode as cv, type FormNode as cw, type FormFieldRef as cx, type ConditionNode as cy, type EndNode as cz, type CurrencyAttribute as d, formulaConfigSchema as d$, type WorkflowError as d0, type PendingAction as d1, type WorkflowInstance as d2, isInstanceTerminal as d3, isInstanceWaiting as d4, canResumeInstance as d5, createStartTransition as d6, type ParticipationStatus as d7, type SignedLinkAuth as d8, type PinCodeAuth as d9, type Uuid as dA, type TenantId as dB, type UserId as dC, asTenantId as dD, asUserId as dE, generateId as dF, generatePrefixedId as dG, registry as dH, viewRegistry as dI, type ValidationMessages as dJ, DEFAULT_VALIDATION_MESSAGES as dK, textConfigSchema as dL, textareaConfigSchema as dM, richtextConfigSchema as dN, numberConfigSchema as dO, checkboxConfigSchema as dP, dateConfigSchema as dQ, phoneConfigSchema as dR, currencyConfigSchema as dS, statusConfigSchema as dT, locationConfigSchema as dU, selectConfigSchema as dV, multiselectConfigSchema as dW, fileConfigSchema as dX, userConfigSchema as dY, relationConfigSchema as dZ, ratingConfigSchema as d_, type ParticipationAuth as da, type WorkflowParticipation as db, isSignedLinkAuth as dc, isPinCodeAuth as dd, canParticipate as de, canAuthenticate as df, canExecuteNode as dg, type GeneratedDocument as dh, type WorkflowExecutionContext as di, createEmptyContext as dj, getContextValue as dk, setContextValue as dl, mergeFormToSlot as dm, type WorkflowAccessMode as dn, type ReadOnlyReason as dp, type FormFieldContext as dq, type FormFieldRow as dr, type FormNodeInfo as ds, type FormContextResponse as dt, type ThemeLogo as du, type ThemeColors as dv, type ThemeTypography as dw, DEFAULT_THEME as dx, mergeWithDefaults as dy, generateCssVariables as dz, type Option as e, type QueryBuilderState as e$, rollupConfigSchema as e0, attributeConfigSchemas as e1, getAttributeConfigSchema as e2, validateAttributeConfig as e3, parseAttributeConfig as e4, safeParseAttributeConfig as e5, createTextValidator as e6, createNumberValidator as e7, createCheckboxValidator as e8, createDateValidator as e9, getMissingRequiredAttributes as eA, isRecordComplete as eB, computeRecordStatus as eC, type DatabaseAdapter as eD, ParticipationTokenService as eE, getDefaultTokenService as eF, initializeTokenService as eG, type ParticipationTokenPayload as eH, type TokenGenerationOptions as eI, type TokenVerificationResult as eJ, PinCodeService as eK, getDefaultPinCodeService as eL, initializePinCodeService as eM, type PinCodeGenerationOptions as eN, type PinCodeVerificationResult as eO, type CacheKeyType as eP, hashOptions as eQ, type CacheAdapter as eR, type CacheOptions as eS, cacheKeys as eT, cacheTtl as eU, defaultTtl as eV, NoopCacheAdapter as eW, type FetchResult as eX, type FormattedRecord as eY, type GroupedFetchResult as eZ, type InsertOptions as e_, createPhoneValidator as ea, createCurrencyValidator as eb, createStatusValidator as ec, createSelectValidator as ed, createMultiselectValidator as ee, createLocationValidator as ef, createFileValidator as eg, createUserValidator as eh, createSingleRelationValidator as ei, createMultiRelationValidator as ej, createRelationValidator as ek, createRatingValidator as el, createFormulaValidator as em, createRollupValidator as en, createTextAreaValidator as eo, createRichtextValidator as ep, createAttributeValidator as eq, createFormAttributeValidator as er, createObjectValidator as es, type ValidationResult as et, validateAttribute as eu, validateObject as ev, validateObjectOrThrow as ew, createDraftValidator as ex, validateDraft as ey, validateDraftOrThrow as ez, type StatusAttribute as f, type FormulaResult as f$, type RegistryMap as f0, type RegistryObjectNames as f1, type ShortcutOperator as f2, createDefaultState as f3, formatRecord as f4, formatRecords as f5, QueryMultipleResultsError as f6, QueryNoResultError as f7, SHORTCUT_TO_FILTER_OPERATOR as f8, createQueryBuilder as f9, type ExecutorContext as fA, type ExecutorErrorResult as fB, type ExecutorResult as fC, type ExecutorSuccessResult as fD, type ExecutorWaitResult as fE, type NodeExecutor as fF, complete as fG, error as fH, ExecutorRegistry as fI, success as fJ, wait as fK, ConditionExecutor as fL, EndExecutor as fM, FormExecutor as fN, StartExecutor as fO, evaluateFormula as fP, evaluateFormulaAttribute as fQ, evaluateFormulaAttributeWithRelations as fR, evaluateFormulaWithRelations as fS, evaluateFormulaWithResult as fT, extractFormulaVariables as fU, extractRelationNames as fV, extractRelationReferences as fW, flattenRelationsForEval as fX, formatFormulaResult as fY, hasRelationReferences as fZ, validateFormulaExpression as f_, QueryBuilder as fa, type QueryBuilderOptions as fb, type EvaluationResult as fc, type EvaluationTrace as fd, evaluateCondition as fe, evaluate as ff, evaluateWithTrace as fg, TenantContextError as fh, addSchemaToContext as fi, getSchemaByNameFromContext as fj, getSchemaContext as fk, getSchemaFromContext as fl, hasSchemaContext as fm, runWithMergedSchemaContext as fn, runWithSchemaContext as fo, type SchemaContext as fp, getContext as fq, getTenantId as fr, getUserId as fs, hasContext as ft, runWithContext as fu, withTenantContext as fv, type TenantContext as fw, createDefaultExecutorRegistry as fx, getDefaultExecutorRegistry as fy, type ExecutorCompleteResult as fz, type SelectAttribute as g, type RelationOptionsResponse as g$, getPathDepth as g0, getRelationPath as g1, getTargetAttributeName as g2, InvalidPathError as g3, MaxDepthExceededError as g4, parsePath as g5, pathHasManyCardinality as g6, validatePath as g7, type PathCardinality as g8, type PathSegment as g9, type WorkflowParticipationsRepository as gA, type AuditRepository as gB, type PermissionsRepository as gC, type AIConversationsRepository as gD, type AIUserMemoryRepository as gE, type AIUsageMetricsRepository as gF, BaseService as gG, BaseRepository as gH, type SchemaContextAware as gI, SchemaContextAwareRepository as gJ, TenantAwareRepository as gK, TenantAwareService as gL, type CreateCustomObjectInput as gM, type AddAttributeInput as gN, type UpdateObjectInput as gO, type ObjectSchemaServiceOptions as gP, ObjectSchemaService as gQ, type RecordServiceOptions as gR, RecordService as gS, type RecordQueryServiceOptions as gT, type QueryOptions as gU, type SearchQueryOptions as gV, type QueryResult as gW, RecordQueryService as gX, type RelationValidationResult as gY, type RelationValidationError as gZ, type RelationOption as g_, type PathSegmentType as ga, type SchemaResolver as gb, resolveMultiplePaths as gc, resolveSingleValue as gd, traversePath as ge, type TraversalOptions as gf, type TraversalResult as gg, type AttributeChange as gh, type HookContext as gi, type HookDefinition as gj, type HookHandler as gk, type HookType as gl, NoopHookRegistry as gm, type HookRegistry as gn, createMockAdapter as go, defaultPolicyRegistry as gp, PolicyRegistry as gq, notesPolicy as gr, type ObjectsRepository as gs, type AttributesRepository as gt, type UserProfilesRepository as gu, type FilesRepository as gv, type ObjectRecordsRepository as gw, type ViewsRepository as gx, type WorkflowsRepository as gy, type WorkflowInstancesRepository as gz, type SingleRelationAttribute as h, type StorageUploadInput as h$, type GetRelationOptionsParams as h0, type RelationServiceOptions as h1, type ResolveIdsBatchRequest as h2, type ResolveIdsBatchResponse as h3, RelationService as h4, RecordResolverService as h5, type ResolvedRelations as h6, type FormulaResolverServiceOptions as h7, FormulaResolverService as h8, type RollupResult as h9, type StartWorkflowInput as hA, type ResumeWorkflowInput as hB, type WorkflowInstanceServiceOptions as hC, WorkflowInstanceService as hD, type CreateParticipationInput as hE, type CreateParticipationResult as hF, type AuthenticationResult as hG, WorkflowParticipationService as hH, type FieldReadOnlyResult as hI, WorkflowRelationService as hJ, type UserValidationResult as hK, type UserValidationError as hL, UserService as hM, type UserProfileServiceOptions as hN, UserProfileService as hO, AuditService as hP, buildAuditChanges as hQ, type FileServiceOptions as hR, FileService as hS, GeocodingService as hT, GlobalSearchService as hU, type PermissionServiceOptions as hV, PermissionService as hW, type CreateViewInput as hX, type UpdateViewInput as hY, ViewService as hZ, type FileContent as h_, type RollupServiceOptions as ha, RollupService as hb, type RollupSchedulerOptions as hc, RollupScheduler as hd, applyDefaultValues as he, checkPermission as hf, getPolicy as hg, buildPolicyContext as hh, checkRecordAccess as hi, checkRecordModifyOrThrow as hj, checkRecordDeleteOrThrow as hk, checkSharedObjectWriteAccess as hl, computeLabel as hm, type LabelResolver as hn, enrichWithFormulas as ho, enrichRecordsWithFormulas as hp, createContextForCreate as hq, createContextForUpdate as hr, createContextForDelete as hs, createContextForRestore as ht, recalculateParentRollups as hu, type RollupCascadeContext as hv, type CreateWorkflowInput as hw, type UpdateWorkflowInput as hx, type WorkflowServiceOptions as hy, WorkflowService as hz, type MultiRelationAttribute as i, type StorageUploadResult as i0, type SignedUrlOptions as i1, type StorageAdapter as i2, type UploadFileInput as i3, type SyncResult as i4, type SyncOptions as i5, syncNativeObjects as i6, verifyNativeObjectsSync as i7, getSyncPreview as i8, type FullSyncResult as i9, type FileListOptions as iA, type DBView as iB, type CreateDBView as iC, type UpdateDBView as iD, type UpsertDBView as iE, type DBWorkflow as iF, type CreateDBWorkflow as iG, type UpdateDBWorkflow as iH, type DBWorkflowInstance as iI, type CreateDBWorkflowInstance as iJ, type UpdateDBWorkflowInstance as iK, type DBWorkflowParticipation as iL, type CreateDBWorkflowParticipation as iM, type UpdateDBWorkflowParticipation as iN, type OperationResult as iO, type ViewSyncResult as iP, type ViewSyncOptions as iQ, syncNativeViews as iR, verifyNativeViewsSync as iS, getViewSyncPreview as iT, type FullSyncOptions as ia, syncAll as ib, DEFAULT_LABEL_FALLBACK as ic, renderLabelExpression as id, isLabelExpression as ie, extractAttributeNames as ig, enrichValuesForDisplay as ih, enrichValuesWithSelectLabels as ii, extractRelationIds as ij, type RelationLabelResolver as ik, computeLabelWithRelations as il, type DBObject as im, type CreateDBObject as io, type UpdateDBObject as ip, type UpsertDBObject as iq, type DBAttribute as ir, type CreateDBAttribute as is, type UpdateDBAttribute as it, type UpsertDBAttribute as iu, type CreateObjectRecord as iv, type ListOptions as iw, type SearchOptions as ix, type GlobalSearchOptions as iy, type GlobalSearchResultItem as iz, type RelationTarget as j, type RatingAttribute as k, type FormulaAttribute as l, type FormulaReturnType as m, type RollupAttribute as n, type RollupFunction as o, type AttributeType as p, type ObjectDefinition as q, type Field as r, type AttributeGroupField as s, type TableTab as t, type InverseTableTab as u, type ViewDefinition as v, type InstanceStatus as w, type Tab as x, type FilterState as y, type SortRule as z };
+export { type OcrAdapter as $, type Attribute as A, type SortRule as B, type CheckboxAttribute as C, type DateAttribute as D, type DirectTableTab as E, type FileAttribute as F, type Group as G, type WorkflowConfig as H, type InferAttributeValue as I, type SlotMode as J, type ConditionGroup as K, type LocationAttribute as L, type MultiselectAttribute as M, type NumberAttribute as N, type ObjectAction as O, type PhoneAttribute as P, type ConditionRule as Q, type RichtextAttribute as R, type SystemResource as S, type TextAttribute as T, type UserAttribute as U, type ViewLayout as V, type WorkflowTheme as W, type WorkflowNode as X, type WorkflowDefinition as Y, type FlowRow as Z, type DocumentTemplate as _, type DocumentAttribute as a, type AuditActorType as a$, type OcrInput as a0, type OcrOptions as a1, type OcrResult as a2, type OcrPage as a3, type OcrTextBlock as a4, type BoundingBox as a5, type SignatureAdapter as a6, type CreateSignatureInput as a7, type SignerRequest as a8, type SignaturePosition as a9, type AIBatchQuestionAnswer as aA, type AITodoStatus as aB, type AITodoItem as aC, type AITodoList as aD, type AIMessageAttachment as aE, type AIConversation as aF, type AIMessage as aG, type AIToolCallRecord as aH, type AIUserMemory as aI, type AIUsageMetrics as aJ, type AIProviderMetrics as aK, type CreateAIMessageInput as aL, type StatusGroup as aM, type AttributeGroup as aN, type BaseAttribute as aO, type NumberUnit as aP, type DateFormat as aQ, type DateValue as aR, type Phone as aS, type Currency as aT, type Location as aU, type LocationGranularity as aV, RELATION_TARGET_ANY as aW, type RelationAttribute as aX, isUniversalRelation as aY, type AuditResourceType as aZ, type AuditAction as a_, type SignatureRequestResult as aa, type SignatureStatusResult as ab, type SignerStatus as ac, type SignatureStatus as ad, type IdentityVerificationAdapter as ae, type VerifyInput as af, type VerificationResult as ag, type DocumentData as ah, type VerificationCheck as ai, type AIMessageRole as aj, type AIThinkingLevel as ak, type AIToolCallStatus as al, type AIToolCall as am, type AIChatMessagePartType as an, type TextPartData as ao, type ToolPartData as ap, type ThinkingPartData as aq, type ReasoningPartData as ar, type AIChatMessagePart as as, type AIChatMessage as at, type AIQuestionType as au, type AIQuestionOption as av, type AIQuestion as aw, type AIQuestionAnswer as ax, type AIBatchQuestionOption as ay, type AIBatchQuestion as az, type SystemAction as b, type NoValueOperator as b$, type AuditChange as b0, type AuditLogEntry as b1, type CreateAuditLogInput as b2, type AuditListOptions as b3, type AuditServiceOptions as b4, type VariableMapping as b5, type PdfTemplateField as b6, type TemplateSource as b7, type DocumentGenerationTemplate as b8, type CreateDocumentGenerationTemplate as b9, type FileVisibility as bA, type File as bB, type CreateFile as bC, type UpdateFile as bD, type TextFilterOperator as bE, type NumberFilterOperator as bF, type CheckboxFilterOperator as bG, type DateFilterOperator as bH, type SelectFilterOperator as bI, type MultiselectFilterOperator as bJ, type RelationFilterOperator as bK, type FilterOperator as bL, type RelativeDateValue as bM, type CurrencyFilterValue as bN, type PhoneFilterValue as bO, type FilterValue as bP, type FilterRule as bQ, type ExtendedFilterRule as bR, type FilterCombinator as bS, type FilterGroup as bT, type AdvancedFilterState as bU, isAdvancedFilterState as bV, toAdvancedFilterState as bW, toSimpleFilterState as bX, type SortDirection as bY, type QueryState as bZ, OPERATORS_BY_TYPE as b_, type UpdateDocumentGenerationTemplate as ba, type PendingDocumentRequest as bb, isPdfTemplateSource as bc, isDocxTemplateSource as bd, type DocumentSlotDefinition as be, type DocumentAutoProcessing as bf, type ExtractionMapping as bg, type ExtractionField as bh, type Document as bi, type DocumentStatus as bj, type DocumentSlot as bk, type SlotStatus as bl, type ProcessingJob as bm, type ProcessingJobType as bn, type ProcessingJobStatus as bo, type CreateDocument as bp, type UpdateDocument as bq, type CreateDocumentTemplate as br, type UpdateDocumentTemplate as bs, type CreateDocumentSlot as bt, type UpdateDocumentSlot as bu, type CreateProcessingJob as bv, type UpdateProcessingJob as bw, type DocumentListOptions as bx, type DocumentTemplateListOptions as by, type StorageProvider as bz, type TextAreaAttribute as c, type UserRole as c$, NO_VALUE_OPERATORS as c0, isNoValueOperator as c1, type FlowSlot as c2, type FlowRowField as c3, type FlowPage as c4, type FlowRelation as c5, type FlowStatus as c6, type FlowDefinition as c7, isFlowDefinition as c8, isFlowPublished as c9, type ExtractAttributes as cA, type TypedObjectRecord as cB, type ExtractObjectRecord as cC, type ExtractObjectRecordWithCustom as cD, RESERVED_ATTRIBUTE_NAMES as cE, SYSTEM_FIELD_NAMES as cF, type ReservedAttributeName as cG, type SystemFieldName as cH, type Timestamps as cI, type SharingMode as cJ, type ObjectAttribute as cK, type CompletionStatus as cL, type ObjectRecord as cM, type PermissionScope as cN, type Role as cO, type Permission as cP, type UserRoleAssignment as cQ, type EffectivePermissions as cR, type ObjectPermissions as cS, type SystemPermissions as cT, type CreateRoleInput as cU, type UpdateRoleInput as cV, type CreatePermissionInput as cW, type AssignRoleInput as cX, type PolicyContext as cY, type RecordPolicy as cZ, PolicyViolationError as c_, isSystemFlow as ca, type GeocodingSuggestion as cb, type GeocodingAutocompleteParams as cc, type ReverseGeocodingParams as cd, type GeocodingParams as ce, type GeocodingAdapter as cf, NoopGeocodingAdapter as cg, type AttributeSchema as ch, type InferRecordFromSchema as ci, type InferRecordWithRequirements as cj, type TypedAttribute as ck, type AttributeMap as cl, type AddAttribute as cm, type InferRecord as cn, type InferRecordInput as co, type InferRecordUpdate as cp, type CustomAttributeValue as cq, type WithCustomAttributes as cr, type RecordMetadata as cs, type SystemFields as ct, type ExtractRecord as cu, type ExtractRecordStrict as cv, type ExtractRecordInput as cw, type ExtractRecordInputStrict as cx, type ExtractRecordUpdate as cy, type ExtractRecordUpdateStrict as cz, type RichtextFeature as d, type CreateInvitationInput as d$, type UserStatus as d0, type UserProfile as d1, type CreateUserProfile as d2, type UpdateUserProfile as d3, type InviteUserInput as d4, type TabType as d5, type FormTab as d6, type CustomTab as d7, type ActivityTab as d8, type NotesTab as d9, isStartNode as dA, type ConditionOperator as dB, and as dC, eq as dD, inValues as dE, isConditionGroup as dF, isConditionRule as dG, isEmpty as dH, isNotEmpty as dI, neq as dJ, or as dK, type CanvasViewport as dL, type NodePosition as dM, type WorkflowLayout as dN, type WorkflowSlot as dO, type WorkflowStatus as dP, isSystemWorkflow as dQ, isWorkflowDefinition as dR, isWorkflowPublished as dS, type PendingAction as dT, type WorkflowError as dU, type WorkflowInstance as dV, type WorkflowTransition as dW, canResumeInstance as dX, createStartTransition as dY, isInstanceTerminal as dZ, isInstanceWaiting as d_, type FlowsTab as da, type DocumentsTab as db, isFormTab as dc, isTableTab as dd, isDirectTableTab as de, isInverseTableTab as df, isCustomTab as dg, isActivityTab as dh, isNotesTab as di, isFlowsTab as dj, isDocumentsTab as dk, type ConditionNode as dl, type DocumentNode as dm, type EndNode as dn, type FormFieldRef as dp, type FormNode as dq, type StartNode as dr, type WorkflowNodeType as ds, getNodeOutputs as dt, isAdvancedFormNode as du, isConditionNode as dv, isDocumentNode as dw, isEndNode as dx, isFormNode as dy, isSimpleFormNode as dz, type CurrencyAttribute as e, attributeConfigSchemas as e$, type CreateInvitationResult as e0, type InvitationStatus as e1, type WorkflowInvitation as e2, isInvitationAccepted as e3, isInvitationExpired as e4, isInvitationValid as e5, type CreateGrantInput as e6, type WorkflowAccessGrant as e7, canAccessNode as e8, isGrantExpired as e9, generateId as eA, generatePrefixedId as eB, slugify as eC, generateTemplateName as eD, registry as eE, viewRegistry as eF, type ValidationMessages as eG, DEFAULT_VALIDATION_MESSAGES as eH, textConfigSchema as eI, textareaConfigSchema as eJ, richtextConfigSchema as eK, numberConfigSchema as eL, checkboxConfigSchema as eM, dateConfigSchema as eN, phoneConfigSchema as eO, currencyConfigSchema as eP, statusConfigSchema as eQ, locationConfigSchema as eR, selectConfigSchema as eS, multiselectConfigSchema as eT, fileConfigSchema as eU, userConfigSchema as eV, relationConfigSchema as eW, ratingConfigSchema as eX, formulaConfigSchema as eY, rollupConfigSchema as eZ, documentConfigSchema as e_, isGrantRevoked as ea, isGrantValid as eb, isTokenRevoked as ec, type GeneratedDocument as ed, type WorkflowExecutionContext as ee, createEmptyContext as ef, getContextValue as eg, mergeFormToSlot as eh, setContextValue as ei, type FormContextResponse as ej, type FormFieldContext as ek, type FormFieldRow as el, type FormNodeInfo as em, type ReadOnlyReason as en, type WorkflowAccessMode as eo, type ThemeColors as ep, type ThemeLogo as eq, type ThemeTypography as er, DEFAULT_THEME as es, generateCssVariables as et, mergeWithDefaults as eu, type Uuid as ev, type TenantId as ew, type UserId as ex, asTenantId as ey, asUserId as ez, type Option as f, QueryMultipleResultsError as f$, getAttributeConfigSchema as f0, validateAttributeConfig as f1, parseAttributeConfig as f2, safeParseAttributeConfig as f3, createTextValidator as f4, createNumberValidator as f5, createCheckboxValidator as f6, createDateValidator as f7, createPhoneValidator as f8, createCurrencyValidator as f9, computeRecordStatus as fA, type DatabaseAdapter as fB, WorkflowJwtService as fC, type JwtVerificationResult as fD, type MagicLinkPayload as fE, type WorkflowAccessPayload as fF, type WorkflowJwtConfig as fG, type WorkflowJwtPayload as fH, type CacheKeyType as fI, hashOptions as fJ, type CacheAdapter as fK, type CacheOptions as fL, cacheKeys as fM, cacheTtl as fN, defaultTtl as fO, NoopCacheAdapter as fP, type FetchResult as fQ, type FormattedRecord as fR, type GroupedFetchResult as fS, type InsertOptions as fT, type QueryBuilderState as fU, type RegistryMap as fV, type RegistryObjectNames as fW, type ShortcutOperator as fX, createDefaultState as fY, formatRecord as fZ, formatRecords as f_, createStatusValidator as fa, createSelectValidator as fb, createMultiselectValidator as fc, createLocationValidator as fd, createFileValidator as fe, createUserValidator as ff, createSingleRelationValidator as fg, createMultiRelationValidator as fh, createRelationValidator as fi, createRatingValidator as fj, createFormulaValidator as fk, createRollupValidator as fl, createTextAreaValidator as fm, createRichtextValidator as fn, createAttributeValidator as fo, createFormAttributeValidator as fp, createObjectValidator as fq, type ValidationResult as fr, validateAttribute as fs, validateObject as ft, validateObjectOrThrow as fu, createDraftValidator as fv, validateDraft as fw, validateDraftOrThrow as fx, getMissingRequiredAttributes as fy, isRecordComplete as fz, type StatusAttribute as g, parsePath as g$, QueryNoResultError as g0, SHORTCUT_TO_FILTER_OPERATOR as g1, createQueryBuilder as g2, QueryBuilder as g3, type QueryBuilderOptions as g4, type EvaluationResult as g5, type EvaluationTrace as g6, evaluateCondition as g7, evaluate as g8, evaluateWithTrace as g9, error as gA, ExecutorRegistry as gB, success as gC, wait as gD, ConditionExecutor as gE, DocumentExecutor as gF, EndExecutor as gG, FormExecutor as gH, StartExecutor as gI, evaluateFormula as gJ, evaluateFormulaAttribute as gK, evaluateFormulaAttributeWithRelations as gL, evaluateFormulaWithRelations as gM, evaluateFormulaWithResult as gN, extractFormulaVariables as gO, extractRelationNames as gP, extractRelationReferences as gQ, flattenRelationsForEval as gR, formatFormulaResult as gS, hasRelationReferences as gT, validateFormulaExpression as gU, type FormulaResult as gV, getPathDepth as gW, getRelationPath as gX, getTargetAttributeName as gY, InvalidPathError as gZ, MaxDepthExceededError as g_, TenantContextError as ga, addSchemaToContext as gb, getSchemaByNameFromContext as gc, getSchemaContext as gd, getSchemaFromContext as ge, hasSchemaContext as gf, runWithMergedSchemaContext as gg, runWithSchemaContext as gh, type SchemaContext as gi, getContext as gj, getTenantId as gk, getUserId as gl, hasContext as gm, runWithContext as gn, withTenantContext as go, type TenantContext as gp, createDefaultExecutorRegistry as gq, getDefaultExecutorRegistry as gr, type ExecutorCompleteResult as gs, type ExecutorContext as gt, type ExecutorErrorResult as gu, type ExecutorResult as gv, type ExecutorSuccessResult as gw, type ExecutorWaitResult as gx, type NodeExecutor as gy, complete as gz, type SelectAttribute as h, type RelationOption as h$, pathHasManyCardinality as h0, validatePath as h1, type PathCardinality as h2, type PathSegment as h3, type PathSegmentType as h4, type SchemaResolver as h5, resolveMultiplePaths as h6, resolveSingleValue as h7, traversePath as h8, type TraversalOptions as h9, type AIUsageMetricsRepository as hA, type DocumentTemplatesRepository as hB, type DocumentsRepository as hC, type DocumentSlotsRepository as hD, type DocumentJobsRepository as hE, type DocumentGenerationTemplateListOptions as hF, type DocumentGenerationTemplatesRepository as hG, BaseService as hH, BaseRepository as hI, type SchemaContextAware as hJ, SchemaContextAwareRepository as hK, TenantAwareRepository as hL, TenantAwareService as hM, type CreateCustomObjectInput as hN, type AddAttributeInput as hO, type UpdateObjectInput as hP, type ObjectSchemaServiceOptions as hQ, ObjectSchemaService as hR, type RecordServiceOptions as hS, RecordService as hT, type RecordQueryServiceOptions as hU, type QueryOptions as hV, type SearchQueryOptions as hW, type QueryResult as hX, RecordQueryService as hY, type RelationValidationResult as hZ, type RelationValidationError as h_, type TraversalResult as ha, type AttributeChange as hb, type HookContext as hc, type HookDefinition as hd, type HookHandler as he, type HookType as hf, NoopHookRegistry as hg, type HookRegistry as hh, createMockAdapter as hi, defaultPolicyRegistry as hj, PolicyRegistry as hk, notesPolicy as hl, type ObjectsRepository as hm, type AttributesRepository as hn, type UserProfilesRepository as ho, type FilesRepository as hp, type ObjectRecordsRepository as hq, type ViewsRepository as hr, type WorkflowsRepository as hs, type WorkflowInstancesRepository as ht, type WorkflowInvitationsRepository as hu, type WorkflowAccessGrantsRepository as hv, type AuditRepository as hw, type PermissionsRepository as hx, type AIConversationsRepository as hy, type AIUserMemoryRepository as hz, type SingleRelationAttribute as i, type UserProfileServiceOptions as i$, type RelationOptionsResponse as i0, type GetRelationOptionsParams as i1, type RelationServiceOptions as i2, type ResolveIdsBatchRequest as i3, type ResolveIdsBatchResponse as i4, RelationService as i5, RecordResolverService as i6, type ResolvedRelations as i7, type FormulaResolverServiceOptions as i8, FormulaResolverService as i9, DocumentProcessingHook as iA, GrantNotFoundError as iB, GrantExpiredError as iC, GrantRevokedError as iD, TokenRevokedError as iE, type GrantServiceConfig as iF, type CreateGrantResult as iG, WorkflowAccessGrantService as iH, type StartWorkflowInput as iI, type ResumeWorkflowInput as iJ, type WorkflowInstanceServiceOptions as iK, WorkflowInstanceService as iL, type InvitationServiceConfig as iM, InvitationNotFoundError as iN, InvitationExpiredError as iO, InvitationAlreadyAcceptedError as iP, InvitationRevokedError as iQ, WorkflowInvitationService as iR, type FieldReadOnlyResult as iS, WorkflowRelationService as iT, type CreateWorkflowInput as iU, type UpdateWorkflowInput as iV, type WorkflowServiceOptions as iW, WorkflowService as iX, type UserValidationResult as iY, type UserValidationError as iZ, UserService as i_, type RollupResult as ia, type RollupServiceOptions as ib, RollupService as ic, type RollupSchedulerOptions as id, RollupScheduler as ie, applyDefaultValues as ig, checkPermission as ih, getPolicy as ii, buildPolicyContext as ij, checkRecordAccess as ik, checkRecordModifyOrThrow as il, checkRecordDeleteOrThrow as im, checkSharedObjectWriteAccess as io, computeLabel as ip, type LabelResolver as iq, enrichWithFormulas as ir, enrichRecordsWithFormulas as is, createContextForCreate as it, createContextForUpdate as iu, createContextForDelete as iv, createContextForRestore as iw, recalculateParentRollups as ix, type RollupCascadeContext as iy, type DocumentProcessingHookOptions as iz, type MultiRelationAttribute as j, type GlobalSearchOptions as j$, UserProfileService as j0, AuditService as j1, buildAuditChanges as j2, DocumentGenerationTemplateNotFoundError as j3, DocumentGenerationNotConfiguredError as j4, DocumentGenerationService as j5, type DocumentProcessingConfig as j6, DocumentProcessingService as j7, type RenderDocumentInput as j8, type DocumentRendererOptions as j9, type SyncOptions as jA, syncNativeObjects as jB, verifyNativeObjectsSync as jC, getSyncPreview as jD, type FullSyncResult as jE, type FullSyncOptions as jF, syncAll as jG, DEFAULT_LABEL_FALLBACK as jH, renderLabelExpression as jI, isLabelExpression as jJ, extractAttributeNames as jK, enrichValuesForDisplay as jL, enrichValuesWithSelectLabels as jM, extractRelationIds as jN, type RelationLabelResolver as jO, computeLabelWithRelations as jP, type DBObject as jQ, type CreateDBObject as jR, type UpdateDBObject as jS, type UpsertDBObject as jT, type DBAttribute as jU, type CreateDBAttribute as jV, type UpdateDBAttribute as jW, type UpsertDBAttribute as jX, type CreateObjectRecord as jY, type ListOptions as jZ, type SearchOptions as j_, type RenderDocumentResult as ja, DocumentRenderError as jb, StorageDownloadNotSupportedError as jc, DocumentRendererService as jd, DocumentTemplateService as je, type RecordDocumentsResult as jf, type CreateRecordDocumentInput as jg, type CreateRecordDocumentResult as jh, type DocumentServiceOptions as ji, DocumentService as jj, type FileServiceOptions as jk, FileService as jl, GeocodingService as jm, GlobalSearchService as jn, type PermissionServiceOptions as jo, PermissionService as jp, type CreateViewInput as jq, type UpdateViewInput as jr, ViewService as js, type FileContent as jt, type StorageUploadInput as ju, type StorageUploadResult as jv, type SignedUrlOptions as jw, type StorageAdapter as jx, type UploadFileInput as jy, type SyncResult as jz, type RelationTarget as k, type GlobalSearchResultItem as k0, type FileListOptions as k1, type DBView as k2, type CreateDBView as k3, type UpdateDBView as k4, type UpsertDBView as k5, type DBWorkflow as k6, type CreateDBWorkflow as k7, type UpdateDBWorkflow as k8, type DBWorkflowInstance as k9, type CreateDBWorkflowInstance as ka, type UpdateDBWorkflowInstance as kb, type DBWorkflowInvitation as kc, type CreateDBWorkflowInvitation as kd, type UpdateDBWorkflowInvitation as ke, type DBWorkflowAccessGrant as kf, type CreateDBWorkflowAccessGrant as kg, type UpdateDBWorkflowAccessGrant as kh, type OperationResult as ki, type ViewSyncResult as kj, type ViewSyncOptions as kk, syncNativeViews as kl, verifyNativeViewsSync as km, getViewSyncPreview as kn, type RatingAttribute as l, type FormulaAttribute as m, type FormulaReturnType as n, type RollupAttribute as o, type RollupFunction as p, type AttributeType as q, type ObjectDefinition as r, type Field as s, type AttributeGroupField as t, type TableTab as u, type InverseTableTab as v, type ViewDefinition as w, type InstanceStatus as x, type Tab as y, type FilterState as z };